[R5N3T]

What are the most effective security techniques to protect websites from SQL injection attacks?

[i am]

Use a NoSQL database.
Or actually understand development and never allow a scenario where your code is interpreting user input as anything but user input. Don't rely on sanitization, WAF, etc.

[R5N3T]

Thank you, that’s a really great piece of advice.

[•^v^–[ bLacKn3x ]–^v^•]

Use prepared statements / parameterized queries instead of concatenating user input into SQL.

Validate and sanitize input according to the expected data type and format.

Use least-privilege database accounts so the application has only the permissions it needs.

Hide detailed SQL errors from users and log them securely on the server.

Never trust user input, including GET/POST parameters, JSON, cookies, and HTTP headers.

Use parameterized queries. Input validation alone is not enough.

Use WebApp Firewall ! (waf)



No. NoSQL does not automatically protect against injection!

It mainly avoids classic SQL Injection because there is no SQL query language involved. However, NoSQL databases can still be vulnerable to NoSQL/Query Injection.



MongoDB → NoSQL Injection
CouchDB → Query Injection
Redis → Command Injection
Neo4j → Cypher Injection