Tech teamRunning a website or small org
Injection (incl. SQL injection)
Hostile input your app or database runs as instructions.
Understand it
If an app passes whatever a user types straight into a database query or a command, an attacker can type commands in place of data - reading, altering or deleting the whole database.
How to spot it
On your own app: anywhere user input reaches a database or a system command without strict handling.
Close the gap
- Use parameterised queries - never assemble SQL from raw input.
- Validate and constrain input to what you actually expect.
- Give the database account the least access it needs.
- Keep frameworks current; they handle much of this for you.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.