SQL injection occurs when an application lets untrusted input alter the structure of a database query. The correction belongs in how the application builds and executes queries, not just in a list of blocked words.
Keep query structure separate from values
Use parameterized queries or prepared statements with bound values. This lets the database distinguish the intended query from user-supplied data. OWASP’s prevention guidance also covers least privilege and the situations that require explicit allowlists.
Placeholders generally represent values, not arbitrary table names, column names or sort directions. When a user can choose a sort order, map the permitted choices to fixed identifiers in application code rather than inserting an unchecked request value.
Use validation for its proper job
A form can require a valid date or a bounded numeric identifier. That improves data quality, but it does not remove the need for safe query construction. Escaping text manually or blocking a few SQL keywords is not a reliable substitute for parameter binding.
Reduce the impact of a defect
- Give the application database account only the permissions it needs.
- Keep detailed database errors out of public responses.
- Maintain the framework, CMS and extensions that construct queries.
- Review custom reporting, search and import features as well as login forms.
What to request from the developer
Ask for the affected code path, the corrected query construction and a focused regression check. For a customer search, normal names containing apostrophes should still work, and unexpected input should not change which records the user is allowed to access.
A security plugin or web application firewall may reduce some exposure, but it does not prove that the underlying code is safe. Test only systems you are authorized to assess, preferably using a controlled copy and non-sensitive data.
If an incident is suspected, preserve the evidence and determine whether data or access was affected. Use the website incident response checklist and review the separate protections against cross-site scripting.