Concatenating user input directly into SQL strings (`'SELECT * FROM users WHERE name = '' + input + '''`) allows input like `' OR '1'='1` to bypass all authentication. Prepared statements separate query bytecode compilation from parameter data values, making injection physically impossible at the database driver level.

CTFs are divided into 5 standard categories: Web, Crypto, Forensics, Rev (Reverse Engineering), and Pwn (Binary Exploitation). Start with PicoCTF: solve the 50-point web challenges (inspecting page source, modifying cookies, basic SQL injections), then learn Ghidra for reverse engineering simple binaries. The dopamine of finding your first flag is unmatched.