Critical ThreatWeb & Injection DefenseCWE-89
Modern SQL Injection Defense: Prepared Statements & ORM Traps
Defend against modern SQL injection using prepared statements, strict parameterization, and avoiding common ORM vulnerabilities.
Vulnerability Overview
Untrusted data concatenated into SQL queries allows arbitrary query execution.
Attackers inject SQL metacharacters like quotes to break out of data context.
Vulnerable Code
db.query('SELECT * FROM users WHERE name = ' + name);String concatenation.
Remediated Code
db.query('SELECT * FROM users WHERE name = $1', [name]);Parameterized query.
Hardening Rules
- 1Use parameterized queries
- 2Avoid dynamic SQL
- 3Employ least privilege
Frequently Asked Questions
Do ORMs prevent all SQLi?
No, dynamic column names or raw queries can still be vulnerable.