Input interpreted as instruction.
WHAT INJECTION IS
Input interpreted as part of a command rather than as data.
WHERE IT OCCURS
Database queries System commands Template rendering Anywhere input is combined with instruction
WHAT IT ALLOWS
Reading or altering any data Sometimes control of the server
WHAT PREVENTS IT IN DATABASES
Parameterised queries, where values are sent separately from the statement.
Without exception.
WHAT CANNOT BE PARAMETERISED
Column and table names.
WHAT TO DO ABOUT THOSE
Validate against a fixed list of permitted values.
WHAT PREVENTS COMMAND INJECTION
Never building a command by joining strings containing input.
WHAT TO DO INSTEAD
Pass arguments as a list, without a shell.
WHAT DOES NOT PREVENT INJECTION
Escaping applied inconsistently Checking for suspicious words Validation alone
WHY VALIDATION ALONE IS INSUFFICIENT
Legitimate input contains characters that are dangerous in the wrong context.
WHAT TO TEST
Submitting quotes and unusual characters in every field.
