SQL Injection Prevention: A Language-by-Language Guide (PHP, Python, Node.js, .NET)
.jpg)
SQL injection has been on the OWASP Top 10 for over two decades, and it still shows up in real codebases in 2026 — not because developers don't know it exists, but because the vulnerable pattern is easy to write by accident under deadline pressure. The fix is the same idea in every language: never build a query by concatenating untrusted input into a string. Here's what that looks like, and what the safe version looks like, across four common stacks.
Why it happens
A SQL query is just a string until the database parses it. If user input becomes part of that string before parsing, the database can't distinguish "data" from "instructions" — an attacker who controls part of the string can inject their own SQL logic. Parameterized queries fix this at the protocol level: the query structure and the data are sent to the database separately, so injected SQL syntax in the data is always treated as literal data, never as part of the query.
PHP
$stmt= $pdo->query("SELECT * FROM users WHERE email = '".$email."'");
// ✓ Safe — PDO prepared statement
$stmt= $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);
Python
cursor.execute(f"SELECT * FROM users WHERE email = '{email}'")
# ✓ Safe — parameterized (DB-API style)
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))
Node.js
connection.query(`SELECT * FROM users WHERE email = '${email}'`);
// ✓ Safe — parameterized (mysql2 / pg style)
connection.query('SELECT * FROM users WHERE email = ?', [email]);
.NET
varcmd= newSqlCommand($"SELECT * FROM Users WHERE Email = '{email}'", connection);
// ✓ Safe — parameterized
varcmd= newSqlCommand("SELECT * FROM Users WHERE Email = @Email", connection);
cmd.Parameters.AddWithValue("@Email", email);
The pattern that connects all of these
?, %s, or a named parameter)Auditing an existing codebase for exactly this pattern, or building something new that needs to be safe from the start? This is part of what I cover in DevOps services and application security review engagements.