Injection attack
An injection attack is a security attack in which crafted or untrusted input is interpreted as commands, code, or query structure by a target system.
Secure APIs
An injection attack is an attack in which crafted input is interpreted as commands, code, or query structure by a target system.
- How it is used
- Detects and investigates malicious input in API requests through observability signals.
- How deep it goes
- Defines malicious SQL and script input, then explains logging, reproduction, and sensitive-field exclusion.
- Examples
- Uses malicious SQL or script input, unauthorized or malformed responses, slow requests, and complete request logs.
- What you can do after
- Diagnose injection attempts by correlating request details with errors, statuses, and latency, then reproduce suspicious requests locally.
Practical Automation with PowerShell: Effective scripting from the console to the cloud
An injection attack is an attack in which untrusted input is interpreted as executable code or commands.
- How it is used
- Prevents untrusted server or filter values from changing SQL commands during PowerShell database automation.
- How deep it goes
- Explains string-built query risk, destructive payload behavior, and parameterized mitigation without covering broader injection categories.
- Examples
- Uses server-name filtering, a destructive TRUNCATE payload, Invoke-DbaQuery parameters, and a dynamically assembled WHERE clause.
- What you can do after
- Apply it via Invoke-DbaQuery by separating SQL placeholders from user-supplied values.
Grokking Web Application Security
An injection attack is an attack in which crafted input is interpreted as executable commands or code by a target component.
- How it is used
- Frames untrusted input as a route to code execution, data theft, authentication bypass, and service disruption.
- How deep it goes
- Explains several injection boundaries and gives layered prevention, logging, monitoring, and response-handling guidance without protocol internals.
- Examples
- Uses ransomware deployment, data-store authentication bypass, newline injection, and a Ruby character-filtering expression.
- What you can do after
- Apply parameterization, input validation, least privilege, sanitization, logging, and monitoring to reduce injection opportunities.
Read how Grokking Web Application Security explains injection attack →
Related concepts
- parameterized queryaddressed by · A parameterized query is a database statement with placeholders whose values are supplied separately from the statement text as data.
- SQL injectionincludes · SQL injection is an attack in which crafted, untrusted input alters the structure or meaning of a SQL statement, potentially causing unintended database operations.
- cross-site scripting attackincludes · Cross-site scripting is a web security vulnerability in which attacker-controlled content causes executable script to run in another user’s browser within a trusted application context.
- SQL parameteraddressed by · An SQL parameter is a typed value supplied separately from an SQL statement and associated with a named placeholder in that statement.
- parameteraddressed by · A model parameter is a numerical value, such as a weight or bias, that is learned or set to determine how a model computes outputs.
- metacharactercontrasts with · A regular-expression metacharacter is a character with special syntactic or matching meaning rather than a purely literal meaning.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.