A parameterized query keeps database instructions separate from externally supplied values. User input is treated as data rather than as part of the query structure, reducing the risk that an attacker can change what the database executes. section 1.2.2 section 6.3
This matters because APIs commonly pass query and path parameters into data-layer operations. Unconstrained strings can carry SQL injection payloads, disable intended filters, delay database responses, or expose behavior through errors. section 6.3
A malicious filter
A product endpoint accepting a free-form filter can receive a value such as ' OR 1=1; --, which attempts to bypass query constraints. A time-delay payload using PG_SLEEP(10) demonstrates another possible effect. Parameterize the query, constrain accepted values, and validate input independently of the client application. section 6.3
Use parameterized queries as part of a broader input-safety routine:
- Validate and sanitize every input, including values received directly by the API rather than through a trusted web or mobile application. section 1.2.2 section 6.3
- Constrain selectable fields with explicit values; for example, allow only price, review, or name for sortBy. section 6.3
- Use established API frameworks, DTOs, and fuzz testers to support validation, safe data transfer, and implementation testing. section 1.2.2
