Lesson 02 · 13 min
Injection: SQL, OS commands and ORM pitfalls
Data must never become code. Parameterized queries, execFile instead of exec, and dangerous ORM methods.
13 minLesson 2 of 5Practice includedAsk AI on any point
Injection happens when user data is glued together with code that an interpreter then runs: a database, a shell, a template engine. The interpreter cannot tell where your code ends and the foreign data begins, so it runs everything together. The defense is always the same in essence: pass data separately from the command.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.