LESSON 2.2
SQL injection
Learn key techniques and workflows in Practical Web Security.
4m
intermediate
10,528 students
Overview
Injection happens when data becomes part of the query. Parameterised queries keep the two separate, and they are not optional.
In this lesson you will:
- See how concatenated input changes a query
- Use parameterised queries everywhere
- Limit database privileges to contain the damage
Pro Tip
Never build a query with string concatenation. Parameters are the whole defence, not a style preference.