OWASP Top 10 and Injections: Parameterized Queries

OWASP (Open Worldwide Application Security Project) is a foundation that publishes free resources on application security. Its best-known document, the Top 10, ranks the most critical risks of web applications. The 2025 edition includes:

Rank	Category
A01	Broken Access Control (now includes SSRF)
A02	Security Misconfiguration
A03	Software Supply Chain Failures
A04	Cryptographic Failures
A05	Injection
A06	Insecure Design
A07	Authentication Failures
A08	Software or Data Integrity Failures
A09	Logging and Alerting Failures
A10	Mishandling of Exceptional Conditions

It is not a complete standard: it is an awareness list. For an audit, you rely instead on OWASP’s ASVS (Application Security Verification Standard). In this course, we will concretely address several of these categories, starting with injection.

The mechanism of an injection

An injection occurs when data supplied by the user is interpreted as code. A classic example in Node.js:

// DANGEROUS: the input is pasted into the SQL text
const email = req.body.email; // "x' OR '1'='1"
const sql = "SELECT * FROM users WHERE email = '" + email + "'";
// => SELECT * FROM users WHERE email = 'x' OR '1'='1'
// The condition is always true: the whole table is returned.

The attacker closed the string with an apostrophe and then added their own logic. Depending on the database, they can also read other tables (UNION SELECT) or modify data.

The solution: the parameterized query

With a parameterized (or prepared) query, you send the SQL server the structure on one side and the values on the other. The value can never become SQL, whatever it contains.

// With the PostgreSQL "pg" driver: placeholders $1, $2...
const { rows } = await pool.query(
  "SELECT id, email FROM users WHERE email = $1",
  [email] // value passed separately
);

// With the native node:sqlite module (Node 22.5+) or MySQL: "?" placeholders
const stmt = db.prepare("SELECT id, email FROM users WHERE email = ?");
const user = stmt.get(email);

ORMs (Prisma, Sequelize, Drizzle…) parameterize automatically, unless you use their raw-query functions with concatenation.

The identifier trap

Placeholders only work for values. A column name or a sort direction (ORDER BY price DESC) cannot be parameterized. You then use an allowlist:

const COLONNES_TRI = new Set(["price", "name", "created_at"]);
function clauseTri(col, sens) {
  if (!COLONNES_TRI.has(col)) throw new Error("Invalid sort column");
  const dir = sens === "desc" ? "DESC" : "ASC"; // only two possible values
  return `ORDER BY ${col} ${dir}`;
}

Key takeaways

• Never build SQL (or a shell command) by concatenating external data.
• Replace “escape the apostrophes” with parameterized queries.
• Validate with an allowlist anything that cannot be parameterized.
• The same principle applies to other injections: child_process.execFile with an array of arguments rather than exec with a string.