SQL Injection Anti-Pattern

Severity: Critical

Summary

Attackers execute arbitrary SQL commands by manipulating user input. String concatenation in queries (frequently AI-generated from insecure training data) enables database compromise, data exfiltration, authentication bypass, and remote code execution.

The Anti-Pattern

The anti-pattern is concatenating user data into SQL statements, allowing attackers to break query structure and inject malicious SQL.

BAD Code Example

# VULNERABLE: String concatenation creates injection vector.
import sqlite3

def get_user(db_connection, username):
    # User input concatenated directly into query.
    query = "SELECT * FROM users WHERE username = '" + username + "'"
    cursor = db_connection.cursor()
    cursor.execute(query)
    return cursor.fetchone()

# Attack: username = "admin' OR '1'='1' --"
# Result: "SELECT * FROM users WHERE username = 'admin' OR '1'='1' --'"
# Returns all users, bypassing authentication.

GOOD Code Example

# SECURE: Parameterized queries prevent injection.
import sqlite3

def get_user(db_connection, username):
    # Parameters sent separately and escaped by database driver.
    # Malicious input cannot alter query logic.
    query = "SELECT * FROM users WHERE username = ?"
    cursor = db_connection.cursor()
    cursor.execute(query, (username,))
    return cursor.fetchone()

# Named parameters (preferred for clarity):
# query = "SELECT * FROM users WHERE username = :username"
# cursor.execute(query, {"username": username})

Detection

Look for string concatenation (+, ||, concat(), f-strings, template literals) used to build SQL queries.
Search for calls to execute(), query(), or raw() that take a single string variable which may contain user input.
Check for the use of .format(), %s, or ${} within SQL query strings.
Review any code that dynamically constructs SQL based on user input without proper parameterization.

Prevention

Use parameterized queries: Always use prepared statements for all database operations.
Never concatenate user input: Avoid direct string concatenation in SQL.
Use ORM libraries: Tools with built-in SQL injection protection (SQLAlchemy, Django ORM, Hibernate).
Apply least privilege: Database accounts should have minimal necessary permissions.
Validate input as defense-in-depth: Not primary defense, but supplements parameterization.

Related Security Patterns & Anti-Patterns

Command Injection Anti-Pattern: Similar injection vulnerability but for shell commands.
LDAP Injection Anti-Pattern: Injection vulnerability in LDAP queries.
XPath Injection Anti-Pattern: Injection vulnerability in XML queries.
Missing Input Validation Anti-Pattern: A root cause that enables many injection attacks.

sql-injection-anti-pattern