The One-Line Fix

Injection has a real cure, not a patch: stop building queries out of strings. Once you do, no input can ever be code again — and it is less work, not more.

3 min readNot yet reviewed

Wrenlearner

So how do I escape the quotes? Strip them out? Ban apostrophes?

Rookmentor

None of that. Every one of those is a filter you will get wrong, and an O'Brien in your staff list you just broke. The fix is not to clean the input. It is to never put the input in the query at all.

Parameters, not concatenation

The cure is called a parameterised query, or a prepared statement. You write the query with a placeholder where the value goes, and hand the value to the database separately. The database treats it as a value and only ever as a value — it is never parsed as SQL, because it never reaches the parser as SQL.

The bug

query = "select * from users where name = '" + input + "'"
run(query)

The cure

query = "select * from users where name = ?"
run(query, [input])

The ? is a placeholder, not a quote. input is handed over as a separate argument. ' OR 1=1 -- now searches for a user literally named "' OR 1=1 --", finds nobody, and changes nothing. The attack becomes an ordinary failed search.

Why can the attacker not simply "break out" of a parameter the way they broke out of the quotes?

The things that are not the fix

Injection attracts a lot of folk remedies. None of these is the fix, and leaning on them instead of parameters is how injectable code survives a review.

1escaping quotes    misses every input you forget to escape, and every
2                   encoding trick that reaches the parser anyway
3blocking keywords  "OR", "SELECT" — breaks real names, blocks nothing an
4                   attacker cannot spell around
5a web firewall     buys time, catches known payloads, and is not a fix —
6                   it is a smoke alarm, not a fireproof wall

Line 1Every one of these tries to make dangerous input safe. Parameters make the question moot: the input is never in a position to be dangerous.

Where this leaves you

Every language's database library supports parameters, and using them is less code than building the string by hand — you delete the quotes and the plus signs. There is almost no case where concatenating user input into a query is the right call, and "almost" is doing very little work in that sentence.

Note

The same rule generalises: whenever you are about to build a command, a query, a path, or a template out of a string with someone else's input in it, stop. The fix is nearly always "hand the input to the thing as data", and the bug is nearly always "I built the instruction as a string".