Parameter binding
Providing data values separately from a fixed query statement through a database driver. Placeholders do not generally bind identifiers or keywords.
- Also called
- parameterized query · parameterized queries · prepared statement
- Defined in
- OWASP Query Parameterization Cheat Sheet
Covered in
Recipe
Fix SQL injection in Python sqlite3
Bind query values separately from SQL syntax, then prove the fix preserves legitimate behavior and blocks an injection probe.
Guide
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Practice: SQL injection lab: Separate SQL structure from data with sqlite3 · OS command injection lab: Run git without a shell · SSTI lab: Render a welcome banner without template injection · XXE lab: Parse an uploaded invoice without resolving external entities