Injection prevention

Keep untrusted input from being treated as code or queries.

📖 Key ideas

Injection risks appear when user input is mixed directly into queries or commands.
Use parameterised queries / prepared statements for all database access.
Use well-maintained ORMs and avoid building SQL strings by hand.
Validate input against expected types and formats (allow-lists).
Run database accounts with least privilege.

💡 Real-life example: Parameterised queries are a form with fixed boxes: whatever a user writes stays inside its box and can never change the form.

InjectionUntrusted input interpreted as code

Parameterised queryQuery with placeholders for data

Allow-list validationAccept only known-good input

Least privilegeMinimum permissions needed