Search⌘ K
Home
Courses
SQL Antipatterns: Avoiding the Pitfalls of Database Programming

Antipattern: Execute Unverified Input As Code

Understand the risks of interpolating unverified input into SQL queries that can lead to SQL injection attacks. Learn to identify how malicious input changes SQL syntax and explore methods like input validation and parameterized queries to protect your database from unintended query execution and security breaches.

We'll cover the following...

An SQL injection happens when we interpolate some content into an SQL query string, and the content modifies the syntax of our query in ways we didn’t intend. In the classic example of SQL Injection, the value we interpolate into our string finishes the SQL statement and executes a second complete statement. For instance, if the value of the $bug_id variable is 1234; DELETE FROM Bugs, the resulting SQL shown earlier would look like this:

MySQL
SELECT * FROM Bugs WHERE bug_id = 1234; 
DELETE FROM Bugs;

After this query is executed, we will lose the table. Let’s see the output in the next playground.

MySQL
DELETE FROM Bugs;
SELECT * FROM Bugs;

The query has been executed, but it returns no results.

This type of SQL Injection can be spectacular. ...