SQL statement in request parameter
Summary: PortSwigger Research describes an HTTP request parameter containing SQL syntax that, if incorporated into a SQL query and executed by the server, makes the application almost certainly vulnerable to SQL injection. The guidance states applications should never place user-controllable data directly into SQL queries, and should instead use parameterized queries, also called prepared statements, to insert data into predefined queries.
What you should know: The source is explicit that users must never be able to control or modify the structure of the SQL query itself, so any request parameter that reaches a query unparameterized hands an attacker the shape of the statement, not just its data.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026