LESSON 2.2

SQL injection

04:14·10,528 learners

Alina Costa

In this lesson you will

See how concatenated input changes a query
Use parameterised queries everywhere
Limit database privileges to contain the damage

Injection happens when data becomes part of the query. Parameterised queries keep the two separate, and they are not optional.

What this lesson covers

See how concatenated input changes a query
Use parameterised queries everywhere
Limit database privileges to contain the damage

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

PRO TIP

Never build a query with string concatenation. Parameters are the whole defence, not a style preference.

UP NEXT

2.3 · Cross-site request forgery

09:57

Practical Web Security

33%

2.1 Cross-site scripting (XSS)18:32 2.2 SQL injection04:14 2.3 Cross-site request forgery09:57

Every lesson, searchable to the second.

PRIVACY · TERMS · CONTACT