Lesson 2.2
SQL injection
Injection happens when data becomes part of the query. Parameterised queries keep the two separate, and they are not optional.
4mIntermediate10,528 students
Sign in to watch this lesson
Browsing is free. Create an account to play videos and track your progress.
Overview
Injection happens when data becomes part of the query. Parameterised queries keep the two separate, and they are not optional.
What this lesson covers
- See how concatenated input changes a query
- Use parameterised queries everywhere
- Limit database privileges to contain the damage
This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will:
- See how concatenated input changes a query
- Use parameterised queries everywhere
- Limit database privileges to contain the damage
Pro Tip
Never build a query with string concatenation. Parameters are the whole defence, not a style preference.