Input treated as instruction.
WHERE IT OCCURS
Database queries Operating system commands Template rendering Directory and file paths Log entries Anywhere input joins an instruction
WHAT PREVENTS IT IN QUERIES
Parameterisation, always, with no exceptions.
WHAT CANNOT BE PARAMETERISED
Table and column names, and sort directions.
WHAT TO DO ABOUT THOSE
Match against a fixed list of permitted values.
WHAT PREVENTS COMMAND INJECTION
Never constructing a command from joined strings.
WHAT TO DO INSTEAD
Pass arguments as a list, without invoking a shell.
WHAT PATH TRAVERSAL IS
Input containing sequences that escape an intended directory.
WHAT PREVENTS IT
Resolving the path and confirming it remains within the permitted directory.
WHAT LOG INJECTION IS
Input containing newlines, forging log entries.
WHAT PREVENTS IT
Structured logging, where values are fields rather than concatenated text.
WHAT DOES NOT PREVENT INJECTION
Blocking suspicious words Escaping applied inconsistently
WHAT TO TEST
Quotes, newlines and traversal sequences, in every input.
