In April 2011, Sony's PlayStation Network went offline. The reason: attackers had broken in and stolen the personal data of 77 million accounts — names, addresses, email addresses, dates of birth, and potentially payment card details. The network was down for 23 days. Sony estimated the breach cost them $171 million.

The attack vector: SQL injection. The same technique you are about to learn. Attackers found a place where Sony's application passed user input directly to their database without checking it — and used that to extract everything.

SQL injection has been in the OWASP Top 10 since the list was created. Security researchers have been warning about it for over 20 years. Companies are still getting breached by it today. The gap is not in the knowledge — it is in the implementation.