An e-commerce API accepts user shipping addresses and validates them against a third-party address standardization service. The service returns the canonical form of the address: corrected spelling, full postal code, and standardized format. The API stores the validated address returned by the third-party — not the user’s original input — in the database.

The database insertion uses string concatenation rather than parameterized queries, because the developer reasoned that the address came from a trusted validation service: query = "INSERT INTO orders (address) VALUES ('" + validated_address + "')"

An attacker compromises the address validation API. For addresses submitted by the attacker, the API returns a crafted string: ', (SELECT password FROM users WHERE username='admin')); --. The consuming API inserts this directly into the SQL query without parameterization. The SQL executes as: extract the admin password and insert it into the orders table. The attacker queries their own order to retrieve the extracted credential.