SQL injection
SQL injection is an attack in which crafted, untrusted input alters the structure or meaning of a SQL statement, potentially causing unintended database operations.
Build Python Web Apps with Streamlit
SQL injection is a security vulnerability in which attacker-controlled input alters a database statement to execute unintended SQL commands.
- How it is used
- Uses parameterized queries to protect a Streamlit app’s database operations from attacker-controlled input.
- How deep it goes
- Defines the risk and explains parameter separation, but does not detail attack techniques or testing.
- Examples
- Shows a Database class using text(query) and params, alongside a SELECT query for Alice’s haikus.
- What you can do after
- Apply SQLAlchemy’s text() and params to keep user input separate from SQL structure.
Read how Build Python Web Apps with Streamlit explains SQL injection →
Secure APIs
An SQL injection attack abuses application input handling to manipulate a database query through unsafely handled input.
- How it is used
- Uses SQL injection to connect API input design with database-query safety, validation, testing, and operational defenses.
- How deep it goes
- Explains payload effects, data exposure, resource exhaustion, parameter constraints, parameterization, fuzz testing, and WAF limitations.
- Examples
- Uses product filters, sortBy probing, delayed database responses, and payment-record access to demonstrate injection consequences.
- What you can do after
- Diagnose injection exposure by testing unconstrained parameters, then apply parameterized queries, enumerations, validation, fuzzing, and layered WAF protection.
.NET in Action, Second Edition
A SQL injection vulnerability is a weakness that allows crafted input to alter or execute unintended SQL statements.
- How it is used
- Frames a database-boundary threat to check during a web-service security audit.
- How deep it goes
- Works through an interceptor-based SQL audit and contrasting generated queries, without establishing that every query shape is safe.
- Examples
- Uses an ID lookup, a malicious-looking title in an IN clause, and an EF Core 8 JSON-parameter query.
- What you can do after
- Diagnose/debug with it by auditing raw SQL calls and inspecting statements captured in tests before database execution.
Read how .NET in Action, Second Edition explains SQL injection →
100 SQL Server Mistakes and How to Avoid Them
SQL injection is an attack technique that alters application-generated database statements by supplying crafted input that is interpreted as SQL code.
- How it is used
- Frames SQL injection as a database security responsibility requiring defensive configuration alongside application input validation.
- How deep it goes
- Explains the attack mechanism, demonstrates authentication bypass, shows enabling conditions, and recommends stored procedures without detailing broader secure coding practice.
- Examples
- Uses a C# login page, a Users table, normal and injected T-SQL predicates, and a replacement login stored procedure.
- What you can do after
- Evaluate/understand SQL injection by recognizing altered predicates and favoring stored procedures, coding standards, and strong security posture.
Read how 100 SQL Server Mistakes and How to Avoid Them explains SQL injection →
DuckDB in Action
An SQL injection attack is an attack in which crafted input alters the intended semantics of an SQL statement.
- How it is used
- Protects user-driven SQL workflows by separating input values from statement text.
- How deep it goes
- Explains altered query semantics, parameter separation, prepared statements, and execution, but does not develop attack payloads.
- Examples
- Demonstrates a named GDP parameter in DuckDB and retrieves a single aggregate result through fetchone.
- What you can do after
- Apply it via DuckDB execute and parameterized queries to reduce SQL injection risk from user input.
Build Financial Software with Generative AI (From Scratch)
SQL injection is a vulnerability in which attacker-controlled input changes the intended structure or behavior of a database query.
- How it is used
- Prevents uploaded filenames and other input from altering database commands during ACH-file persistence.
- How deep it goes
- Contrasts unsafe interpolation with parameterized insertion and stops short of detailing attack payloads or database internals.
- Examples
- Uses an ACH upload endpoint that stores a filename and MD5 hash in the ach_files table.
- What you can do after
- Apply it via parameterized SQL statements and verify safe upload persistence with endpoint tests.
Read how Build Financial Software with Generative AI (From Scratch) explains SQL injection →
Building Web APIs with ASP.NET Core
SQL injection is a security vulnerability in which untrusted input changes the structure or meaning of a SQL statement.
- How it is used
- Protects dynamically generated database commands from untrusted values changing SQL execution.
- How deep it goes
- Compares interpolation, parameters, stored procedures, escaping, and EF Core, but does not detail exploit payloads or database internals.
- Examples
- Uses a user-notes UPDATE statement, unsafe C# interpolation, parameterized commands, and an EF Core update.
- What you can do after
- Apply it via SQL parameters or EF Core to keep input values separate from generated SQL commands.
Read how Building Web APIs with ASP.NET Core explains SQL injection →
Cyber Threat Hunting
An attack technique that injects SQL statements into an application’s data-processing input to manipulate database operations.
- How it is used
- Frames SQL injection as an application attack and a web-log hunting target.
- How deep it goes
- Defines injection, names major payload styles, and demonstrates log searches, status analysis, and source investigation without covering remediation.
- Examples
- Uses encoded patient-endpoint requests, SQL payload variants, Flask log queries, status breakdowns, and geographic source-IP summaries.
- What you can do after
- Diagnose/debug with it by searching access logs, decoding request patterns, grouping response codes, and profiling suspicious source addresses.
Grokking Web Application Security
SQL injection is an attack technique that alters a database command by supplying input containing characters or syntax interpreted as SQL.
- How it is used
- Protects web applications that construct database commands from request input.
- How deep it goes
- Explains vulnerable construction, authentication bypass, destructive commands, and parameterized mitigation.
- Examples
- Uses login lookups, a DROP TABLE payload, a comment-based password bypass, and prepared-statement listings.
- What you can do after
- Apply parameterized statements through a database driver to keep dynamic values separate from SQL commands.
Read how Grokking Web Application Security explains SQL injection →
Related concepts
- placeholderaddressed by · A placeholder is a temporary or symbolic stand-in for a value, content, component, or position that is supplied, replaced, or resolved later.
- parameterized queryaddressed by · A parameterized query is a database statement with placeholders whose values are supplied separately from the statement text as data.
- SQLuses · SQL is a standardized declarative language for defining, querying, and manipulating data and structures in relational database systems.
- injection attackkind of · An injection attack is a security attack in which crafted or untrusted input is interpreted as commands, code, or query structure by a target system.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.