NOTE
1.7 SQL Injection
Cause of SQL injection and defense with parameterized queries.
This is a historical learning note and may contain outdated or incomplete understanding.
1. What Is SQL Injection
SQL injection is a web attack in which untrusted input changes the structure or meaning of a SQL statement executed by the server.
2. Why SQL Injection Happens
It commonly occurs when application code concatenates untrusted input directly into SQL text.
3. How to Prevent SQL Injection
3.1. Use Parameterized Queries (Prepared Statements)
- Write SQL with parameter placeholders such as
?. - Bind parameter values with the database driver’s parameterized API instead of constructing SQL by string concatenation.
The key point is separation between SQL structure and data. Bound values are treated as data rather than being parsed as additional SQL syntax.
4. Example
4.1. Golang
Use database/sql or a library built on it with parameter placeholders and bound arguments.