Poisoned Pipeline / Mitigations / M1170
M1170
Use parameterized queries
A parameterized query is a query in which placeholders are used for parameters and the parameter values are supplied at execution time.
Parameterized queries ensure that an attacker is not able to change the intent of a query, even if SQL commands are inserted by an attacker.
Note that parametrized queries should be done on the server-side.
Every language supports their own constructions, please use the references to find appropriate mechanism for your technologies.
Applies to
- T0117 SQL injection