SQL injection

Injection happens when data becomes part of the query. Parameterised queries keep the two separate, and they are not optional.

4m
Intermediate

Video by Server Logic Simplified · YouTube

Check your understanding

3 questions. Unlocks when you finish the video.

Overview

What this lesson covers

See how concatenated input changes a query
Use parameterised queries everywhere
Limit database privileges to contain the damage

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

See how concatenated input changes a query
Use parameterised queries everywhere
Limit database privileges to contain the damage

Resources

OWASP Top 10The official reference for the tools used in this lesson.