Injection Attacks: SQL Injection and XSS

SQL injection. Building a query by string concatenation lets the input rewrite the query:

# vulnerable
query = "SELECT * FROM users WHERE name = '" + name + "'"
# name = "x' OR '1'='1"  ->  WHERE name = 'x' OR '1'='1'   (every row)

The real fix: parameterised queries. The database receives the SQL text and the values separately, so a value can never become syntax:

cur.execute('SELECT * FROM users WHERE name = ?', (name,))

ORMs do this for you unless you drop to raw string building. Identifiers (table or column names) cannot be parameters: validate them against an allow-list.

Why sanitizing is the weaker defence. Stripping quotes or keywords fails on encodings, comments and database-specific syntax. A sanitizer is a backup layer (reject obviously invalid input, limit length, check type) but the parameter binding is what actually protects you. Also give the application's database account only the privileges it needs.

Cross-site scripting (XSS). If a site puts user input into HTML without encoding it, the browser runs injected <script> as if the site wrote it, with access to the user's session. Stored XSS saves the payload (a comment); reflected XSS echoes it from a URL; DOM XSS happens in client-side code.

The XSS fix: encode on output, for the context. Turn < into < and quotes into entities in HTML; use proper encoding inside attributes, URLs and JavaScript. Frameworks like React escape by default - the danger is dangerouslySetInnerHTML and innerHTML. If you must allow rich text, run it through a maintained sanitizer with an allow-list of tags (for example DOMPurify).

Defence in depth for XSS. A Content-Security-Policy header restricts where scripts may load from; HttpOnly cookies stop scripts reading the session cookie; SameSite limits cross-site sending. None of these replaces correct encoding.

The principle. Treat every input as untrusted data, keep it in a data channel (bound parameters, escaped output) and never let it cross into the code channel. The same idea covers command injection, template injection and LDAP injection.