Fix it in your stack

Tested fixes for CWE-89 in Express, Flask, Spring Boot, ASP.NET Core, Next.js, FastAPI, Django, net/http, Rails and Laravel: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.

Definition

MITRE’s description of CWE-89: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Common consequences MITRE lists

  • Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands
  • Confidentiality: Read Application Data
  • Authentication: Gain Privileges or Assume Identity; Bypass Protection Mechanism
  • Access Control: Bypass Protection Mechanism
  • Integrity: Modify Application Data

Why it matters

An injected clause can read or change any data the database account can reach and bypass login checks; on some databases it can also run operating-system commands.

How to prevent it

  • Pass every data value as a bound parameter of a prepared statement; never build SQL by concatenating or formatting strings.
  • Map user choices for identifiers that cannot be parameters, such as column names and sort order, to a fixed allowlist.
  • Prefer ORM and query-builder APIs, and review every remaining raw query.
  • Give the application’s database account only the privileges it needs, and test with quotes, IN lists and LIKE patterns.

Guides on this site

Main subject · Recipe

Fix SQL injection in Python sqlite3

Bind query values separately from SQL syntax, then prove the fix preserves legitimate behavior and blocks an injection probe.

Also covers this · Guide

Combine static and dynamic tests around a verified finding

Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.

Cites this weakness · Guide

Keep generated output out of executable contexts

Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.

Cites this weakness · Case study

Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)

How one unauthenticated SQL injection in an internet-facing file transfer product let the Cl0p group steal data from thousands of organizations in days in 2023, how defenders found the web shell, and the vendor and customer controls that would have limited it.

Cites this weakness · Reference

Threat pattern library for threat modeling

Thirty-two recurring threat patterns grouped by identity, authorization, parsers, concurrency, integrations, data exposure, supply chain, availability and AI agents, each with where it shows up on a data-flow diagram, mitigations, a verification step and STRIDE, CWE and CAPEC links, plus a YAML catalog and a script that lists patterns per diagram element.

Cites this weakness · Guide

Apply CISA Secure by Design: principles, pledge goals and evidence

What CISA's Secure by Design guidance and pledge ask of software manufacturers as of October 2026, and how to turn each of the three principles, the seven pledge goals and the Product Security Bad Practices into engineering actions, metrics and evidence.

Practice

References

  1. CWE-89 in the MITRE CWE list (version 4.20)
  2. 2025 CWE Top 25 Most Dangerous Software Weaknesses (MITRE CWE Program)
  3. OWASP SQL Injection Prevention Cheat Sheet

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.