Injection Attacks: SQL Injection & Command Injection¶

Injection happens when untrusted input is interpreted as code or commands. It remains one of the most damaging web vulnerabilities.

SQL Injection (SQLi)¶

When user input is concatenated directly into a SQL query, an attacker can alter the query's logic.

The Vulnerable Pattern¶

1// ❌ NEVER do this — string concatenation
2const q = "SELECT * FROM users WHERE email = '" + email + "'";

If email is ' OR '1'='1, the query becomes:

1SELECT * FROM users WHERE email = '' OR '1'='1'

...which returns every user. Worse payloads can read other tables, dump password hashes, or (with stacked queries) modify data.

The Fix: Parameterized Queries¶

1// ✅ Parameterized / prepared statement
2const user = await db.query(
3  "SELECT * FROM users WHERE email = $1",
4  [email]
5);

The database treats email strictly as data, never as SQL. This is the single most important defense. ORMs (Prisma, etc.) parameterize by default — but raw queries can still be vulnerable.

Defense in Depth for SQLi¶

1. 1.Parameterized queries / prepared statements (primary).
2. 2.Least-privilege DB accounts — the web app's DB user shouldn't be able to drop tables.
3. 3.Input validation — allow-list expected formats.
4. 4.WAF — catches common patterns (secondary, not a substitute).

Command Injection¶

When user input reaches a shell command:

1// ❌ Vulnerable
2exec("ping -c 1 " + userInput);

Input like 8.8.8.8; rm -rf / runs arbitrary commands. Fix: avoid shelling out; if you must, use APIs that pass arguments as an array (no shell), and strictly validate input.

1// ✅ Safer — no shell interpretation, args array
2execFile("ping", ["-c", "1", userInput]);

Other Injection Variants¶

• LDAP injection, NoSQL injection, XML/XXE, template injection — same root cause, different interpreter.
• The universal fix: separate code from data, validate input, and apply least privilege.

Detection¶

Watch logs for SQL syntax in parameters, sudden errors, or unusual query volumes. Database activity monitoring and WAF logs are valuable detection sources.