Lesson 2.24mIntermediate10.5k students

SQL injection

Injection happens when data becomes part of the query. Parameterised queries keep the two separate, and they are not optional.

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will

  • See how concatenated input changes a query
  • Use parameterised queries everywhere
  • Limit database privileges to contain the damage

Pro tip

Never build a query with string concatenation. Parameters are the whole defence, not a style preference.

Resources