SQL injection
Untrusted input changes the structure of a database query (CWE-89). Bind values as parameters and allowlist any identifiers or keywords built into the query.
- Also called
- SQLi
- Fix it in your stack
- SQL injection fix cards (10 stacks) · CWE-89 page
- Defined in
- MITRE CWE-89
- Identifiers
- CWE-89: SQL injection
Covered in
Fix SQL injection in Python sqlite3
Bind query values separately from SQL syntax, then prove the fix preserves legitimate behavior and blocks an injection probe.
Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)
How one unauthenticated SQL injection in an internet-facing file transfer product let the Cl0p group steal data from thousands of organizations in days in 2023, how defenders found the web shell, and the vendor and customer controls that would have limited it.
Combine static and dynamic tests around a verified finding
Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.
Apply CISA Secure by Design: principles, pledge goals and evidence
What CISA's Secure by Design guidance and pledge ask of software manufacturers as of October 2026, and how to turn each of the three principles, the seven pledge goals and the Product Security Bad Practices into engineering actions, metrics and evidence.
Keep generated output out of executable contexts
Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.
Threat pattern library for threat modeling
Thirty-two recurring threat patterns grouped by identity, authorization, parsers, concurrency, integrations, data exposure, supply chain, availability and AI agents, each with where it shows up on a data-flow diagram, mitigations, a verification step and STRIDE, CWE and CAPEC links, plus a YAML catalog and a script that lists patterns per diagram element.
All 7 pages that cover SQL injection in the library
Practice: XSS lab: Render a model’s answer as text instead of active markup · SQL injection lab: Separate SQL structure from data with sqlite3 · Local project: Run model-generated Python in a locked-down container