The most damaging vulnerability.
WHAT IT IS
User input interpreted as part of a database query.
WHAT IT ALLOWS
Reading any data Modifying or deleting data Sometimes gaining control of the server
WHAT CAUSES IT
Building a query by joining strings containing values from outside.
WHAT PREVENTS IT
Parameterised queries, where values are sent separately from the statement.
Without exception.
WHAT THAT MEANS
The database never confuses a value with instruction.
WHAT ELSE HELPS
Using a query builder or an ORM, which parameterise automatically
WHAT STILL REQUIRES CARE
Raw expressions Dynamic column or table names, which cannot be parameterised
WHAT TO DO ABOUT THOSE
Validate against a fixed list of permitted values.
Never pass them through from input.
WHAT DOES NOT PREVENT IT
Escaping functions, used inconsistently Checking for suspicious words Validation alone
WHAT TO REVIEW
Every place a query is constructed.
WHAT TO TEST
Submitting quotes and unusual characters in every field.
