SQL Injection and Command Injection

SQL injection (SQLi) occurs when an attacker inserts or 'injects' malicious SQL code into an input field that is later passed to a database query. Because the application concatenates user input directly into a SQL statement, the database cannot distinguish between legitimate data and attacker-supplied commands. SQLi consistently ranks as one of the most dangerous web vulnerabilities on the OWASP Top 10.

A vulnerable login query might look like: SELECT * FROM users WHERE username='INPUT' AND password='INPUT'. An attacker supplying ' OR '1'='1 as the username transforms the query so the WHERE clause is always true, bypassing authentication entirely. This is the classic tautology-based injection.

SQL injection attacks come in several forms: In-band SQLi returns results directly in the HTTP response (error-based or union-based). Blind SQLi infers data through Boolean true/false responses or deliberate time delays (SLEEP(5)). Out-of-band SQLi uses secondary channels like DNS lookups to exfiltrate data when responses are not visible.

The primary defense against SQL injection is parameterized queries (also called prepared statements). In a parameterized query, the SQL structure is compiled first, and user input is passed as a separate parameter — it can never alter the query structure. This approach is language-agnostic and far more reliable than input sanitization alone.

While parameterized queries are the primary defense, input validation provides an important secondary layer. Allowlist validation accepts only expected characters (e.g., alphanumeric only for a username field) and rejects everything else. Denylist validation blocks known bad characters, but attackers often encode or obfuscate payloads to bypass denylists — making allowlists far stronger.

Command injection (OS command injection) occurs when an application passes unsanitized user input to a system shell. Unlike SQL injection that targets databases, command injection targets the operating system itself — giving attackers the ability to run arbitrary commands with the privileges of the web server process. It is rated critical severity and often leads to full system compromise.

A web app that pings a user-supplied IP address might use: ping -c 1 INPUT. If an attacker supplies 8.8.8.8; cat /etc/passwd, the shell interprets ; as a command separator and runs both commands. Common injection operators include ;, &&, ||, |, and backtick command substitution.

The safest defense against command injection is to avoid calling OS commands from user input entirely — use library functions that accomplish the same goal. When shell calls are unavoidable, pass arguments as a list (never as a concatenated string), disable shell interpretation, validate input against a strict allowlist, and run processes with the least-privileged user account possible.

The OWASP Top 10 lists Injection (which encompasses SQL, NoSQL, OS, and LDAP injection) as one of the most critical application security risks. OWASP recommends a defense-in-depth approach: use safe APIs that avoid the interpreter, perform positive (allowlist) server-side input validation, escape special characters using the syntax specific to that interpreter, and use SQL controls like LIMIT to prevent mass disclosure.

A Web Application Firewall (WAF) can detect and block common injection payloads by inspecting HTTP requests against signature patterns. However, WAFs can be bypassed through encoding tricks and are not a substitute for secure coding. Proper application logging — recording query parameters, response codes, and error messages — enables security teams to identify injection attempts during incident review.

Injection attacks have caused some of the largest data breaches in history. The 2017 Equifax breach exposed 147 million records via a web application flaw. SQL injection against Sony PlayStation Network compromised 77 million accounts in 2011. These incidents illustrate that injection flaws carry extreme business impact: data theft, regulatory fines, reputational damage, and legal liability all follow a successful injection attack.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: SQL injection exploits unsanitized input concatenated into database queries, command injection passes malicious input to the OS shell via operators like ; and |, and parameterized queries and avoiding shell=True are the primary defenses. Next up we explore Cross-Site Scripting (XSS) and CSRF attacks.