🛡️ Security

Parameterized Query

A database query in which the SQL statement is sent separately from the values it operates on, so user input can never be interpreted as SQL syntax. It is the standard defense against SQL injection, in contrast to building queries by string concatenation.

📚 Deep Dive

Learn Article

How SQL Injection Becomes Root Command Execution on an Appliance

SQL injection is filed under data theft, yet on an appliance it routinely ends in a root shell. The database engine's own file and program features are the bridge, and privilege is the only gate.

intermediate 6 min read

Back to Glossary