A string embedded with quotes, slashes, or semicolons, for example, might perform arbitrary data operations if used unfiltered in a SQL query against a database.

• 例如,如果在对数据库的SQL查询中使用了未经筛选的字符串,则其中嵌入了引号、斜杠或分号的字符串可用于执行任意数据操作。