A1: Injection · 2017

Untrusted data is interpreted as commands or queries

Summary

Untrusted data is interpreted as commands or queries. Injection can alter queries, execute instructions or access information outside the intended flow.

How the attack works

The payload ' OR '1'='1 is concatenated into SQL, making the WHERE condition true and returning rows outside the intended search.

Example

Vulnerable · Pseudocode

surname = "' OR '1'='1"
sql = "SELECT id FROM customers WHERE surname = '"
      + surname + "'"
db.query(sql)

Fix: Parameterize the query: db.query("SELECT id FROM customers WHERE surname = ?", [surname]).

Prevention

Use parameterized APIs and avoid concatenating input into commands.
Validate against allowlists when parameterization is not possible.
Separate data from instructions and test entry points with adversarial cases.

Lineage

2013 · A1: Injection Continues in 2017
2013 · A3: Cross-Site Scripting (XSS) Moves down to rank 7 in 2017
2017 · A1: Injection Continues
2017 · A7: Cross-Site Scripting (XSS) Integrated into Injection
2021 · A03: Injection Absorbs XSS
2025 · A05: Injection Moves down from rank 3

2013:A1 → 2017:A1: Injection retains rank 1.
2013:A3 → 2017:A7: XSS moves down from rank 3 to 7.
2017:A1 → 2021:A03: Injection moves down from rank 1 to 3.
2017:A7 → 2021:A03: XSS is integrated into Injection.
2021:A03 → 2025:A05: Injection moves down from rank 3 to 5.

Sources

Open official source ↗

Buy me a coffee