Injection Prevention (OWASP A01)

Prevent SQL, NoSQL, Command, and other injection attacks by validating and sanitizing all user input.

When to Use

• Reviewing code that builds SQL/NoSQL queries
• Code that executes shell commands
• Any place user input reaches an interpreter
• Building APIs that accept user data
• Migrating from string concatenation to parameterized queries

Injection Types