Injection Prevention

Keep Data Separate from Interpreter Syntax

Applications constantly move data into systems that interpret syntax: databases parse queries, shells parse commands, browsers parse HTML, and template engines parse expressions. A security problem appears when data that should remain inert can change the structure of those instructions. That is the core of injection. If an attacker can influence where instructions end and data begins, the receiving interpreter may perform work the developer never intended. The consequence depends on the interpreter: unauthorized database operations, unintended operating-system actions, or active content in a browser are all possible outcomes of the same design mistake.