Web applications can reduce database injection risk by keeping user input separate from database commands and applying security controls on the server. The main protections include parameterised queries, appropriate input validation, limited database privileges and regular security testing.
What Is Database Injection?
Database injection occurs when untrusted input is allowed to alter the structure or meaning of a database query. Client-side checks alone are not sufficient because requests can bypass browser controls. Validation and security controls therefore need to be enforced on the server.
Use Parameterised Queries
Parameterised queries, also known as prepared statements, separate query structure from the values supplied by a user. This prevents input intended as data from being interpreted as part of the SQL command. Where appropriate, developers can also use ORM frameworks that provide parameterised database access.
Validate Input on the Server
Server-side validation should check that incoming data matches the expected type, length and format. Developers should not rely on manually replacing or escaping selected characters as the main security boundary. Structural protections are generally more reliable than attempting to maintain a blacklist of potentially dangerous input.
Limit Database Privileges
Application database accounts should have only the permissions required for normal operation. An application that only needs to read or update specific records should not normally have unrestricted administrative privileges. Limiting permissions can reduce the impact of a successful compromise.
Maintain and Monitor the Application
Security also depends on ongoing maintenance. Teams should review database access code, monitor relevant logs, update dependencies and use code review or automated security testing to identify unsafe queries before they reach production.
- Use parameterised queries or prepared statements.
- Validate untrusted input on the server.
- Apply the principle of least privilege to database accounts.
- Keep database drivers and dependencies updated.
- Monitor logs and test database access code regularly.
References
- OWASP. SQL Injection Prevention Cheat Sheet.
- UK National Cyber Security Centre. Secure development guidance.
