📋 What Is It?
Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. The root cause is always the same: user input concatenated into a command that an interpreter then executes.
A05
OWASP Rank
33
Mapped CWEs
Interpreter
Target
⚠️ Common Attack Vectors
- SQL Injection — manipulate database queries
- NoSQL Injection — exploit document stores
- OS / Command Injection — run system commands
- LDAP Injection — alter directory queries
- XPath Injection — manipulate XML queries
- Expression Language (EL) / template injection
🔴 Attack Flow
1. Submits hostile input (e.g. admin' --)
↓
2. App concatenates input into a SQL query
↓
3. Injected syntax alters query logic
↓
4. Interpreter executes unintended command
↓
5. BREACH: auth bypass / data exfiltration!
↓
2. App concatenates input into a SQL query
↓
3. Injected syntax alters query logic
↓
4. Interpreter executes unintended command
↓
5. BREACH: auth bypass / data exfiltration!
❌ Vulnerable Code
# WRONG: input concatenated into the query string
query = f"SELECT * FROM users WHERE id = {user_id}"
# Escaping is not enough -- it can be bypassed
escaped = input.replace("'", "''")
query = f"SELECT * FROM users WHERE name = '{escaped}'"
✅ Secure Code
# RIGHT: parameterized query, input stays data
cursor.execute(
"SELECT * FROM users WHERE id = ?",
(user_id,)
)
cursor.execute(
"SELECT * FROM users WHERE name = ?",
(input,)
)
✓ Prevention Checklist
- Use parameterized queries always
- Never concatenate user input into commands
- Validate input; whitelist acceptable patterns
- Apply least privilege to the database user
- Escape output with context-appropriate encoding
- Use ORMs properly; avoid raw queries
- Prefer static SQL; avoid dynamic queries
- Avoid dynamic SQL inside stored procedures
- Do not rely on escaping alone (defense in depth)
- Perform regular security testing
🌍 Real-World & Pitfalls
Heartland Payment Systems (2008): a SQL injection flaw led to ~130M credit-card numbers stolen and roughly $140M in settlements.
Common pitfall: Trusting input validation or escaping alone. Escaping is error-prone and bypassable — parameterized queries keep user input as data, not executable syntax. Use both as defense in depth.
Common pitfall: Trusting input validation or escaping alone. Escaping is error-prone and bypassable — parameterized queries keep user input as data, not executable syntax. Use both as defense in depth.
🔍 Tools & Takeaway
sqlmap
Burp Suite
OWASP ZAP
NoSQLMap
Nikto
semgrep
Key Takeaway: Never concatenate untrusted input into commands or queries — always use parameterized queries, with least-privilege access and input validation as defense in depth.