SQL Injection Prevention Referenz
Referenz für SQL Injection prevention: parameterized queries, ORMs, und validation.
Injection Vectors
SQL injection occurs when user input concatenates into SQL strings without proper handling. Classic attacks use OR 1=1 to bypass auth, UNION SELECT to extract data, and stacked queries for execution. Blind SQLi infers data via boolean or time-based responses. Second-order injection stores payload in the database, executed later in a different query. NoSQL injection targets document databases with operator injection ($where, $ne).
- classic
- OR 1=1, UNION
- blind
- Boolean/time-based
- NoSQL
- Operator injection
auth bypass, extractinfer data$where, $nePrevention Strategies
Parameterized queries (prepared statements) are the primary defense: the query structure and data are sent separately. ORMs parameterize by default but have raw query escape hatches. Stored procedures parameterize if they do not build dynamic SQL internally. Input validation restricts data type and format but cannot replace parameterization. Allowlist input validation for identifiers (table/column names) that cannot be parameterized. Escape functions are error-prone and should be avoided in favor of parameterization.
- parameterized
- Primary defense
- ORM
- Auto-parameterize
- validation
- Supplement, not replace
structure + data separateavoid raw queriestype + format