Home / Knowledge hub / Injection
Knowledge hub
Injection
Input that ends up running as a command instead of being read as text.
What it means
Injection happens when user data reaches something that interprets it, and that interpreter cannot separate the instruction your developer wrote from the text your user typed. The database, shell or template engine reads one string and follows all of it.
String building is the usual cause. A name goes into a query, a path into a system call, a message into a template. A carefully chosen value then changes the meaning of the line it landed in.
Why it matters
The ceiling is high. Depending on where it lands, injection reads your whole database, edits records, walks past a login or runs commands on the server. PortSwigger notes that SQL injection alone lets an attacker view data, change it and sometimes reach the infrastructure behind it. Mild versions are rare.
It is also one of the few classes you can genuinely remove. OWASP's first defence is prepared statements, which stop an attacker changing the intent of a query even when they control the input. Parameters end the problem rather than reducing it. One forgotten query in an old reporting screen keeps it alive.
How it shows up
SQL is the famous case. The same mistake appears in operating system commands, LDAP lookups, XML parsers, NoSQL filters, template engines and spreadsheet exports. Anywhere your code assembles a string and something else then interprets it.
Worth reviewing: search boxes, filters and sort parameters, upload file names, report builders, anything assembling a query from optional fields, and anything shelling out to a command line tool. Treat values from a partner system exactly like values from a stranger. Injection is one of the ten classes we test, and each finding comes back with the request that worked.
Questions people ask
Injection, answered
Is SQL injection still a thing?
It is. Breaches still start this way, and the flaw keeps appearing in new code as well as old. Frameworks removed the easy cases, which means what is left hides in the corners nobody reviews.
Reporting screens, admin tools and search features written in a hurry are where it usually survives.
Does using an ORM prevent injection?
Mostly, while you stay on the normal path. Standard query builders generate parameterised SQL for you, and that is safe by default.
The gap is the raw query escape hatch every ORM provides. The moment somebody drops to raw SQL and pastes a variable into the string, the protection is gone.
Will a web application firewall stop it?
It blocks common payloads and buys you time, and determined attackers work around filters with encoding and timing tricks.
We do not grade firewalls or claim they replace a fix. Treat one as a speed bump while somebody parameterises the query, never as the repair.
Is injection only about SQL?
No. The same shape appears wherever a string gets interpreted: shell commands, LDAP filters, XML parsers, NoSQL queries, template engines and even spreadsheet formulas in an export.
If you glue user input into something that will run, the class applies whatever the technology is called.
Do I need to sanitise input to stop it?
Sanitising helps and it is not the answer on its own. Escaping rules differ per interpreter, and one missed context undoes the effort.
Use parameters, so the data can never be read as instructions. Keep validation as a separate layer that rejects nonsense early.
Related
Terms that sit next to this one
SQL injection
Input a database ends up running as part of a query.
XSS
An attacker's script running in your pages, in your customers' sessions.
Input validation
Checking that what arrives is the shape and range you expected.
Untrusted input
Anything that arrived from outside your own code, and is therefore suspect.
Remote code execution
Getting a server to run commands of an attacker's choosing.
Where does your input end up?
Injection is one of the ten classes we cover. Every finding arrives with the request that worked, the response it returned and the line of code behind it. Start with one application.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.