Typorithm · medium

SQL Injection

sql-injectionsecuritysqliinjectionparameterized

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn SQL Injection

Web Security (OWASP)

SQL injection happens when user input is concatenated into a query, letting an attacker change what the query does. The fix is parameterized (prepared) statements or an ORM that binds values; reinforce it with least-privilege database accounts and input validation.

SQL injection occurs when untrusted input is glued directly into a SQL string. Because the database parses the whole string as code, a crafted id like 1 OR 1=1 turns a single-row lookup into a dump of every row — or worse, lets an attacker drop tables.

The fix is to never build queries by concatenation. Use parameterized (prepared) statements: write a placeholder such as ? and pass the value separately. The driver sends the query template and the data apart, so the input is always treated as a value, never as SQL.

A good ORM parameterizes for you — User.findOne({ where: { id } }) binds id as a parameter under the hood. Pair this with least-privilege database accounts (so a compromised query can do little) and input validation to reject obviously bad data early.

Concatenating input into SQL is the root cause.

Parameterized queries bind values, never code.

ORMs parameterize the where clause by default.

// VULNERABLE: string concatenation
db.query("SELECT * FROM users WHERE id = " + id);
// SAFE: parameterized query
db.query("SELECT * FROM users WHERE id = ?", [id]);
// ORM also parameterizes
User.findOne({ where: { id } });

Read the implementation

Connect each part of the code to the concept before you type.

1. Vulnerable concatenation

Concatenating id straight into the SQL string lets an attacker's input become part of the query — the classic injection bug.

db.query("SELECT * FROM users WHERE id = " + id);

2. Parameterized query

The ? placeholder keeps the query and the data separate; the driver binds id as a value, so it can never alter the query structure.

db.query("SELECT * FROM users WHERE id = ?", [id]);

3. Bound placeholder

A placeholder marks where a value goes; the database treats the bound value purely as data, not as SQL.

WHERE id = ?

4. ORM query

An ORM builds the SQL for you and binds the where values as parameters, so it parameterizes by default.

User.findOne({ where: { id } });

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.