SpeedDrain
OWASP A03:2021 · Injection Visualizer · Prepared Statements

SQL Injection Visualizer & Sanitizer

Analyze why string concatenation triggers catastrophic SQL injection vulnerabilities and see how prepared statements completely neutralize malicious payloads.

Vulnerable Naive ConcatenationEXPLOITABLE
SELECT * FROM users WHERE username = 'admin' OR '1'='1' AND password = 'password123'

What the Database Engine Sees:

The quotation mark broke out of the literal string context. The attacker's input became executable SQL syntax altering the query logic or exfiltrating rows without authorization.

Secure Prepared Statement (Parameterized)100% IMMUNE
SQL Template:SELECT * FROM users WHERE username = $1 AND password = 'password123'
Bound Parameter $1:"admin' OR '1'='1"

Why This Is Immune:

The query structure is pre-compiled by the SQL engine. The parameter value is transferred via a binary protocol and strictly evaluated as literal data. Special characters like ' and -- cannot alter command logic.

Production Implementation Code:
// Node.js (pg / PostgreSQL parameterized query)
import { Pool } from 'pg';
const pool = new Pool();

// SECURE: Values are sent out-of-band via parameters array
const queryText = 'SELECT * FROM users WHERE username = $1 AND password = 'password123'';
const values = [userInput];

const result = await pool.query(queryText, values);

Anatomy of SQL Injection & The Defense in Depth Hierarchy

Why Escaping Quotes Is Insufficient (The Fallacy of Regex Filters)

Many developers attempt to prevent SQL injection by filtering or escaping characters like ' with backslashes (\') or regex replacements.

This approach fails in multiple edge cases: numeric inputs where no quotes are used (WHERE id = 1 OR 1=1), multibyte character encodings (e.g. GBK 0x5c smuggling), and stored second-order injections. Sanitizing strings after string interpolation is fundamentally flawed.

How Parameterized Queries Provide 100% Structural Immunity

Prepared statements split query execution into two distinct phases:

  1. Compilation: The database engine parses the SQL syntax tree with placeholders ($1, ?) and builds an immutable query execution plan.
  2. Parameter Binding: User-provided data is transmitted separately over the database protocol. Even if the data contains SQL keywords like DROP TABLE, the parser never re-analyzes the input as code.