injection-prevention

SQL injection prevention uses prepared statements with parameterized queries to separate code from data. This ensures user input cannot alter command logic, eliminating the most common injection attack vector in database applications.

Command injection prevention avoids shell interpretation by passing arguments as arrays rather than concatenated strings. Use subprocess libraries with array-based APIs and disable shell=True to prevent attackers from injecting shell metacharacters.

Code injection defense restricts dynamic code execution; path traversal defense validates and sanitizes file paths to prevent directory escape. Both require input validation, allowlisting, and avoiding eval-like functions with untrusted data.

Security reviews should identify command, code, SQL, and path traversal injection vectors. Check for unsafe subprocess calls, dynamic SQL concatenation, eval usage, and unvalidated file path operations against OWASP injection checklists.

Automated injection detection scans code for unsafe patterns—shell metacharacters in subprocess calls, SQL string concatenation, and unvalidated path operations. Integration into CI checks catches vulnerabilities before deployment.

Template safety prevents injection by isolating data from template logic through auto-escaping and context-aware encoding. This protects against code and command injection when rendering user-controlled content in templates.