A05: Injection

An injection vulnerability occurs when untrusted user input is sent to an interpreter that executes it as commands. This enables attacks like SQL, OS command, NoSQL, and template injections, leading to data compromise or remote code execution.

To prevent SQL injection, replace dynamic query construction with parameterized queries and safe APIs. You must also implement context-aware escaping and strict input validation across all API endpoints and forms that accept user-supplied data.

The best way to fix OS command and NoSQL injection flaws is to identify untrusted input paths and process them through safe APIs and parameterized interfaces. This requires context-aware escaping and secure coding practices across your tech stack.

Yes, you need parameterized queries for all API endpoints, forms, and dynamic query builders that handle user-supplied input. Combining parameterized interfaces with input validation and context-aware escaping mitigates injection risks across various tech stacks.

You should use context-aware escaping alongside input validation when untrusted data reaches interpreters like SQL, OS commands, NoSQL, or template engines. Escaping ensures the interpreter treats the input strictly as data, preventing execution of injected commands.

Input validation fails to stop template injection when dynamic query builders pass untrusted input directly to template interpreters. Without context-aware escaping and parameterized interfaces, the interpreter executes parts of the input as commands, bypassing basic validation.