This lesson's interactive features are locked, please to keep using them

Injection

Injection refers to a category of vulnerabilities where untrusted input is treated as instructions.

Instead of being handled as ordinary data, user input gets executed by a database, shell, or template engine. Injection is a major application-security risk and is A05 in the OWASP Top 10:2025.

The consequences can be ugly. An attacker might read protected data, DROP database tables, or execute arbitrary commands on the server. A single injection bug can compromise an entire application and its data.

SQL Injection

One of my favorite XKCD comics of all time demonstrates the problem of SQL injection specifically:

Injection bugs often start with string concatenation. The server has an outline of some code to run, like a SELECT query, and fills in the missing pieces with user-provided data.

Imagine an internal customer-directory endpoint that takes an email from the URL and stitches it directly into a SQL query:

app.get("/customers", requireStaff, async (req: Request, res: Response) => {
  const email = String(req.query.email ?? "");
  const query = `
    SELECT id, email, plan
    FROM customers
    WHERE email = '${email}'
  `;
  const result = await db.query(query);
  res.json(result.rows);
});

An attacker can supply an email like this:

' OR 1=1 --

The resulting query becomes:

SELECT id, email, plan FROM customers WHERE email = '' OR 1=1 --'

The -- comments out the rest of the line, and OR 1=1 is always true, so, every row in the customers table is now returned.