This lesson's interactive features are locked, please to keep using them

Injection

Injection refers to a category of vulnerabilities where untrusted input is treated as instructions.

Instead of being handled as ordinary data, user input gets executed by a database, shell, or template engine. Injection is a major application-security risk and is A05 in the OWASP Top 10:2025.

The consequences can be ugly. An attacker might read protected data, DROP database tables, or execute arbitrary commands on the server. A single injection bug can compromise an entire application and its data.

SQL Injection

One of my favorite XKCD comics of all time demonstrates the problem of SQL injection specifically:

Injection bugs often start with string concatenation. The server has an outline of some code to run, like a SELECT query, and fills in the missing pieces with user-provided data.

Imagine an internal customer-directory endpoint that takes an email from the URL and stitches it directly into a SQL query:

email := request.URL.Query().Get("email")
query := `
  SELECT id, email, plan
  FROM customers
  WHERE email = '` + email + `'`
rows, err := database.QueryContext(request.Context(), query)

An attacker can supply an email like this:

' OR 1=1 --

The resulting query becomes:

SELECT id, email, plan FROM customers WHERE email = '' OR 1=1 --'

The -- comments out the rest of the line, and OR 1=1 is always true, so, every row in the customers table is now returned.