Question: I have an XML file with an XSLT stylesheet. Internet Explorer opens and renders the XML file as expected. However, File | Print or File | Print Preview does not show any content. What am I missing?

Thanks.

Answer: 
SQL Injection happens when a programmer gets lazy. A vulnerable query would look like this:

```
DECLARE @cmd varchar(256)

SET cmd='SELECT @col FROM Table'
EXEC @cmd

```

With @col being a variable passed into a stored procedure.

Usually, the user would enter a column in that already exists for that variable. But a more devious user could enter something like this:

```
* FROM Table; DROP DATABASE data;--

```

The \* FROM Table; finishes off the previous statement. Then, DROP DATABASE data; is the payload that does bad things, in this case, dropping the database. Finally, the -- comments out the rest of the query so it doesn't get any errors from the injection.

So, instead of executing this:

```
SELECT column
FROM Table

```

You get this:

```
SELECT *
FROM Table;
DROP DATABASE data;
--

```

Which is not good.

And this:
![alt text](https://i.stack.imgur.com/RiaMH.png)
If your data in properly cleaned and sanatized, a user can try to get their own SQL code to run on the server. for example, let's say you have a query like this:

```
 "SELECT * FROM products WHERE product_type = $type"

```

where type is unchanged user input from a text field. now, if I were to search for this type:

(DELETE FROM products)

You are gonna be in a world of hurt. This is why it's important to make sure all user input in sanatized before running it in the DB.