SQL · Chapter 41 of 42

SQL Injection Safety

SQL INJECTION is when user input is concatenated into a query, letting attackers change its meaning.

Prevention: ALWAYS use PARAMETERIZED queries (prepared statements). Never concatenate user input into SQL.

Example 1 (python)

# BAD — string concat
name = request.form['name']
cur.execute("SELECT * FROM users WHERE name = '" + name + "'")

# GOOD — parameterized
cur.execute("SELECT * FROM users WHERE name = %s", (name,))

Output

safe query

Parameter values are escaped by the driver.

Example 2 (sql)

-- Classic injection input
name = "' OR '1'='1";
-- becomes: SELECT * FROM users WHERE name = '' OR '1'='1'
-- returns EVERY user

Output

attacker sees all users

Concatenation is the entire vulnerability.

Key points

Never concatenate user input into SQL.
Use parameterized queries / prepared statements.
ORMs (SQLAlchemy, Django ORM, Prisma) do this by default.
Also validate/sanitise input as defense in depth.

💡 Note: SQL injection has been the #1 web vulnerability for over a decade. The fix — parameterized queries — is trivial. Always use them.

SQL Injection Safety

Key points

📝 Quick Quiz