Injection Check Skill

Injection is the class of vulnerability where user-supplied input is interpreted as part of a command or query rather than as data. An agent generating database or shell code will often use string formatting because it is simpler. Simpler is what gets exploited.

What to Check Before Writing Input-Handling Code

SQL Injection Scan for string concatenation or f-string/format-string construction of SQL queries. Every parameterized query is safe. Every concatenated query is a vulnerability.

Patterns to flag:

• "SELECT * FROM users WHERE id = " + user_id
• f"SELECT * FROM users WHERE name = '{name}'"
• cursor.execute("DELETE FROM orders WHERE id = %s" % order_id) (note: %s with % substitution, not parameterized)
• Raw query builders that accept unsanitized field names for ORDER BY or column selection

Command Injection Any code that passes user input to os.system, subprocess, exec, eval, shell=True, or equivalent in any language is a block condition unless the input is fully validated against a whitelist.