injection-prevention

Injection Prevention

Comprehensive injection prevention patterns for SQL, XSS, command injection, path traversal, LDAP, and template injection across all major languages and frameworks.

Knowledge Base

The Fundamental Principle

Injection occurs when untrusted data is interpreted as code or structure by a downstream processor. The universal prevention is to ensure the processor can distinguish data from code. This is achieved through:

1. Parameterization -- Sending data through a separate channel from code (prepared statements, argument arrays)
2. Context-aware encoding -- Transforming data so it is inert in the target context (HTML encoding, URL encoding)
3. Allowlist validation -- Accepting only data that matches a known-safe pattern (enum values, regex matching)

Denylist filtering (blocking known-bad characters) is almost always insufficient because there are too many encoding variations and bypass techniques.

SQL Injection

Root cause: User input concatenated into SQL query strings.

Prevention by language:

# VULNERABLE
cursor.execute(f"SELECT * FROM users WHERE name = '{name}'")

# SECURE - Parameterized query
cursor.execute("SELECT * FROM users WHERE name = %s", (name,))

# SECURE - Django ORM (parameterized by default)
User.objects.filter(name=name)

# VULNERABLE - Django raw with string formatting
User.objects.raw(f"SELECT * FROM users WHERE name = '{name}'")

# SECURE - Django raw with params
User.objects.raw("SELECT * FROM users WHERE name = %s", [name])

// VULNERABLE
db.query(`SELECT * FROM users WHERE name = '${name}'`);

// SECURE - Parameterized (pg library)
db.query('SELECT * FROM users WHERE name = $1', [name]);

// SECURE - Prisma ORM (parameterized by default)
prisma.user.findMany({ where: { name } });

// VULNERABLE - Sequelize literal
sequelize.query(`SELECT * FROM users WHERE name = '${name}'`);

// SECURE - Sequelize parameterized
sequelize.query('SELECT * FROM users WHERE name = :name', {
  replacements: { name }
});