Security · Advanced

Injections: separating an instruction from data

In one line: Every place a string from the user is assembled into a command is a hole — and the fix is parameters, not filtering.

The one principle

The engine should receive the command and the data separately. Parameterized queries, system commands with an argument array, and template engines that mark unsafe content. Filtering strings is a race you always lose.

Where it appears

Databases, operating system commands, library queries, calls to a search engine, and also in dynamically built addresses. And yes — also in prompts to a language model, where external content may be interpreted as an instruction.

Defense in depth

Minimal permissions for the database user, so even if something got through, the damage is limited. And input validation against a schema — not as a substitute for separation, but as an added layer that blocks absurd input in the first place.

Going deeper

Run automated tests that feed unusual input to every field — special characters, extreme length, different encodings — and check that the response is an orderly error and not anomalous behaviour. That catches ordinary bugs too, not just vulnerabilities.

Security