Injection Attacks
Overview
An injection attack occurs when an application accepts untrusted input and treats it as a command or instruction — affecting databases, operating systems, web servers, and application code.
Key concepts
- SQL, command, LDAP, NoSQL, XML, code injection
- Parameterized queries and input validation as primary defenses
How it works
An injection attack occurs when an application accepts untrusted input and treats it as a command or instruction — affecting databases, operating systems, web servers, and application code.
Types
| Type | What it targets |
|---|---|
| SQL injection | Malicious database commands inserted into an input field. |
| Command injection | Malicious operating-system commands inserted into an input field. |
| LDAP injection | Malicious input changes a query sent to a directory service. |
| NoSQL injection | Malicious input changes a query sent to a non-relational database. |
| XML injection | Malicious XML content inserted into an application. |
| Code injection | Malicious code inserted into an application and executed by the server. |
Preventing injection
- Validate all user input before processing it.
- Use parameterized queries for database requests.
- Avoid passing untrusted input directly to operating-system commands.
- Use allowlists to restrict acceptable input values.
- Apply least privilege to application and database accounts.