Injection and output
Use parameterized database queries
Keep SQL structure separate from values so user input cannot become executable database syntax.
8 minute lesson
SQL injection appears when data is concatenated into a query string. Parameters keep the value in the value channel.
Use prepared statements or the parameter API from a maintained database library. Validate business constraints too, but do not rely on escaping by hand. Identifiers such as column names need a fixed allowlist because normal value parameters do not represent them.
SELECT id, title
FROM notes
WHERE owner_id = ? AND id = ?A search query concatenates owner_id and the search term into SQL. A crafted quote changes the condition and returns another user’s notes.
Parameters protect values, not dynamic table names or sort columns. Keep identifiers in a fixed mapping instead of passing them through the value API.
Replace one concatenated query with parameters and capture its result for a title containing a quote. Test SQL control characters and an unsupported sort field, then verify no extra rows or schema changes appear.
Lesson completed