Injection beyond SQL
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
stop untrusted input from being run as code or queries.
Planned topics
- Injection: input is glued into a command so that data becomes code.
- SQL and JPQL: never concatenate input into a query; use parameters (
:name,?). - Other targets: OS commands, LDAP, expression languages, log lines (log injection with newlines).
- Validation helps, but parameterization is the real fix.
- Sorting column names and similar cannot be parameters: check them against an allow-list.
Draft outline details
Demonstration
// Vulnerable
em.createQuery("select p from Product p where p.name = '" + name + "'");
// Safe
em.createQuery("select p from Product p where p.name = :name").setParameter("name", name);Check your understanding
What stops SQL injection reliably?
Show answer
Parameterized queries.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.