Payloads, tricks, defenses

Quick payload reference

Bypass tricks for naive filters

Defense — the real fixes

None of the bypasses above matter if you use parameterized queries. That's the whole point. All of these are language-specific examples of doing it right:

# Python sqlite3 / psycopg2 / mysql-connector
cur.execute("SELECT * FROM users WHERE username = ? AND password = ?", (u, p))

# SQLAlchemy
session.execute(text("SELECT * FROM users WHERE id = :id"), {"id": user_id})

# Node.js with mysql2
conn.execute("SELECT * FROM users WHERE id = ?", [user_id])

# PHP PDO
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");
$stmt->execute(['id' => $user_id]);

# Java with PreparedStatement
PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
stmt.setInt(1, userId);

# C# / .NET
using (var cmd = new SqlCommand("SELECT * FROM users WHERE id = @id", conn)) {
    cmd.Parameters.AddWithValue("@id", userId);
}

Where you can't parameterize — column names, table names, and ORDER BY directions can't bind through most drivers. For these, use a strict allowlist:

ALLOWED_SORT = {"created_at", "name", "price"}
sort_col = request.args.get("sort", "created_at")
if sort_col not in ALLOWED_SORT:
    sort_col = "created_at"
query = f"SELECT * FROM products ORDER BY {sort_col}"  # safe — sort_col is from a fixed set

Defense in depth

What NOT to do

• Don't write your own escape function. You will miss an edge case (multibyte encodings, backslash poisoning, dialect-specific quirks). Use the driver's parameterization.
• Don't blacklist keywords. Attackers always find new encodings, comment splits, case variations. Allowlist or parameterize.
• Don't trust client-side validation. JavaScript checks are UX, not security. Anyone can bypass them with curl.
• Don't sanitize on input only. Level 5 demonstrates why — data flows through your system in unpredictable ways. Parameterize at the SQL boundary, every time.
• Don't trust ORM auto-protection blindly. Most ORMs parameterize by default but expose raw query methods (.raw(), .execute(), text()). Those are foot-guns.

Tools worth knowing