Injection Attacks

Every injection is one failure: untrusted data crosses into an interpreter and is parsed as code. The defense follows — keep data out of the grammar by parameterizing or passing structured arguments, with allowlist validation and least privilege behind it.

Parameterization sends SQL and values on separate channels: the engine parses the statement first, then binds values as pure data, so input never re-enters the parser as code. Escaping still builds one string, and one missed rule restores syntax.

XXE happens when an XML parser resolves an external entity declared in the document, so the document pulls in a local file or an internal URL. The fix is parser configuration, not input filtering: disable DTD processing and external entities.

Both hide the query result. Boolean-based detection needs a response that still differs — page length, status or content flips with a true or false condition. When the response never varies, only latency is left, so a deliberate delay in the injected condition confirms execution.

An ORM parameterizes only the queries it builds itself. Helpers taking a raw fragment — raw(), text(), a hand-written where string — hand that text straight to the driver, so an interpolated value is parsed as SQL again.

The application builds a command line from user input and hands it to a shell. The shell is a full interpreter, so metacharacters split one command into several and input becomes code. The fix is to skip the shell: run the binary with an argument array.

The parameter's quote reached the SQL parser and closed the literal early, which proves the query is concatenated — this is SQL injection, not bad input. Fix both: bind ref as a parameter and stop returning the driver error to the client.

The value is stored safely by a parameterized insert and only later read back and concatenated into another query, often by a report or background job. Source and sink sit in different requests, so scanners see nothing and execution is blind.

Mongo filters are documents, so a raw JSON value can arrive as an operator object instead of a scalar: a field expecting a string gets one holding $ne, and the comparison always matches. Fix by casting each field to its expected type.

Both formats use a newline as a structural delimiter. An unfiltered newline in a header value ends that header early and lets an attacker append headers or a body, splitting the response; in a log it forges a record. Fix by rejecting control characters.

Auto-binding copies every field of a request body onto a model, so a client adds an attribute the form never showed — a role or an owner id — and it is persisted. An allowlist inverts the default: only fields that endpoint may write are bound.

With shell=True the shell parses the whole assembled string, so filename can append further commands. Remove the shell and pass an argument list, then constrain the value: reduce it to a basename matching a strict allowed pattern.

A template engine is an interpreter. Input passed as a value is only substituted, but input compiled as template source is executed inside the server process. The fix is structural: templates come from your codebase, user data is only a bound variable.

An argument array removes the shell but not the target binary's own option parser. A value starting with a dash is read as a flag, so input changes what the tool does, not what it acts on. Fix with an end-of-options -- and reject option-shaped values.

Parameter entities let a document make the parser open an outbound connection, so data leaves over a side channel and no output is needed. The primary control is unchanged — disable DTDs and external entities — with egress limits behind it.