Question

I’m in the midst of applying SQL parameters to my project to prevent SQL Injection.

Do I add parameters to every query in my application, including the queries that don’t have any user interaction?

For example, if my user wanted to search for a keyword and submitted a text field. I’ve added the parameterized method to the query that used that keyword, to stop the user adding something malicious. But underneath this query, is another query, which get’s the keyword ID from the top search and runs it’s own little query elsewhere.

This is what’s confusing to me, do I add the parameter method to this query too, even though the keyword ID wasn’t from the user?

Many thanks

Answer 1

Yes, use parameterized queries in any place you have parameters.

The fact that today no user input is used on a specific query doesn’t mean tomorrow will be the same. Code changes. Perhaps a malicious user will figure out how to compromise the first query and then the second one.

You should think about defense in depth.