Is there a canonical SQL injection page that I can point people towards when they post a question with an SQL injection vulnerability? Is it polite to do this. Sometimes, I know it's just an example, and that it isn't real code so it's OK if it has SQL injection vulnerabilities. However, when it's a new user, with low rep asking a very simple question, I find it very hard not to try and teach them about the dangers of SQL Injection. Is there a specific Stackoverflow question I can point them to? Or is there some other page on the internet that better explains the problem. and can help them fix it.
Yes, xkcd's Little Bobby Tables is standard. It must be one of the most frequently linked pages at SO.
Why, uh, here's a nice answer to a sql injection question that you could link to. Over and over. Pretty please.
Point them to OWASP, they have good ressources that explains well the security problem, what to do and what not to do. It is one of the rare places that you are sure to find quality information about security problem.
Pages they have about SQL Injection :
I'm a fan of the Wikipedia page on SQL injection because it provides an adequate description of the problem, provides an overview of the solution, and lists notable hacks where it was a factor.
It's also rather long, so it might not actually be read.
Someone needs to do a rant on the subject equal to the Cthulhu answer on regular expressions and HTML.
This answer seems like a reasonable bet for PHP + MySQL, which I'd bet is the worst offender:
I've just edited in a link to the bobby tables question to give context.
I learned about it at sqlzoo.net/hack.