Parameterized Query Defense: Code vs. Data Plane

SQL injection succeeds only when attacker-supplied text gets tokenized as if it were code the developer wrote. This simulation renders a real query pipeline in 3D — token stream, parser, syntax tree, execution engine and result rows — and lets you run the same malicious payload through two construction modes. In vulnerable mode the payload is concatenated into the SQL text before parsing, so its keywords become live syntax and the AST grows extra branches that leak rows. In parameterized mode the query is compiled first and the payload is bound afterward as one opaque, never-re-tokenized data value, so it can only ever match as a literal string. Live readouts track AST node count, rows returned and whether the payload was re-tokenized, showing exactly where the security boundary sits.