I learnt sql can be used to retrieve credit card info on a web. Is that true?

Answer 1

If the web site stores credit card information in database and the site itself isn't protected against SQL injection then yes, it is true.

Answer 2

no