Suggest an edit

Improve this article

Refine the answer for “How do you protect against SQL injections?”. Your changes go to moderation before they’re published.

Approval required

Content

What you’re changing

Title (EN)

Short answer (EN)

Shown above the full answer for quick recall.

Answer (EN)

Protection against SQL injections comes down to **never letting a user directly influence the SQL statement**.

### The main techniques

Here are the main techniques:

1. **Use parameterized queries (prepared statements).**
Instead of concatenating strings with user input, pass the data as parameters.
Example (Python + PostgreSQL):

```python
  cursor.execute("SELECT * FROM users WHERE login = %s", (user_input,))
  ```
Here the input isn't inserted into the query text, it's passed safely.
2. **Never build queries through string concatenation.**
Never do this:

```python
  "SELECT * FROM users WHERE login = '" + user_input + "'"
  ```
3. **Validate and constrain user input.**
Allow only valid characters, lengths, and formats (e.g. only letters and digits).
4. **Use an ORM or framework.**
For example, SQLAlchemy, Django ORM, Hibernate, they automatically escape parameters.
5. **Limit database user privileges.**
The application should connect as a user that **has no rights** to drop tables or change the schema.
6. **Log and monitor suspicious queries.**
To catch attempted attacks quickly.

**Summary:** protection against SQL injections comes down to **parameters instead of strings**, **input validation**, and **minimal privileges** for the database account.

Markdown · drag & drop images · ⌘B / ⌘I shortcuts183 words

For the reviewer

Note to the moderator (optional)

Visible only to the moderator. Helps review go faster.