Why String Concatenation in SQL Queries Can Expose You to Injection Attacks

Question

Introduction

Security vulnerabilities are often the result of small oversights — and one of the most dangerous examples is SQL Injection, a flaw that can expose your entire database to attackers.

At its core, SQL Injection happens when you build SQL queries using string concatenation with untrusted user input.
Let’s look at why this is so risky, how it works, and what you can do to fix it.

---

The Problem: String Concatenation with User Input

Imagine you’re writing a simple login function in Python that checks if a user exists:

username = input("Enter username: ")
query = "SELECT * FROM users WHERE name = '" + username + "';"

At first glance, this seems harmless — but it’s not.

If a malicious user types this instead:

' OR '1'='1

The resulting query becomes:

SELECT * FROM users WHERE name = '' OR '1'='1';

That OR '1'='1' condition is always true, which means the database will return all rows.
In an authentication system, that could mean bypassing login entirely.

---

What Attackers Can Do with SQL Injection

SQL injection vulnerabilities can lead to:

• Bypassing authentication (logging in without a password)
• Dumping sensitive data like emails, credit card info, or hashed passwords
• Modifying or deleting records
• Taking control of the underlying server

In the worst case, attackers can chain SQLi with remote code execution, leading to a full system compromise.

---

Why It Happens

SQL injection happens because the application trusts user input and directly concatenates it into SQL queries.

When SQL interpreters parse the query, the injected text is treated as part of the SQL command, not as data.

That’s why using parameterized queries or prepared statements is critical — they separate code from data.

---

✅ The Correct Way: Use Parameterized Queries

Here’s how to fix it safely:

Example in Python (using SQLite or PostgreSQL)

username = input("Enter username: ")
cursor.execute("SELECT * FROM users WHERE name = %s", (username,))

Example in Node.js (using Sequelize)

const username = req.body.username;
const user = await db.query(
  "SELECT * FROM users WHERE name = ?",
  { replacements: [username], type: QueryTypes.SELECT }
);

Example in Java (using JDBC)

PreparedStatement stmt = conn.prepareStatement(
  "SELECT * FROM users WHERE name = ?"
);
stmt.setString(1, username);
ResultSet rs = stmt.executeQuery();

All these examples ensure the database treats the user input as data only, preventing injection.

---

Additional Security Best Practices

1. Always validate and sanitize user input.
   Even with prepared statements, it’s good practice to enforce input rules (e.g., alphanumeric usernames).

2. Use ORM frameworks (like Sequelize, SQLAlchemy, Hibernate) — they handle parameterization by default.

3. Enable least privilege access for your database users — the app should not have admin rights.

4. Keep error messages generic.
   Don’t return detailed SQL errors to users; they can reveal database structure.

5. Regularly scan your code using tools like:

   • OWASP Dependency Check
   • SonarQube
   • ️♂️ Burp Suite or OWASP ZAP

---

TL;DR

❌ Insecure	✅ Secure
"SELECT * FROM users WHERE name = '" + user + "';"	"SELECT * FROM users WHERE name = ?" (parameterized)

---

Key Takeaway

String concatenation may seem convenient, but it’s a ticking time bomb in database code.
By using parameterized queries, input validation, and secure coding practices, you can protect your applications from one of the oldest — and still most dangerous — vulnerabilities on the web.

---

Further Reading

• OWASP SQL Injection Guide
• NIST Secure Coding Practices
• SQLAlchemy Parameterized Queries Docs

---

✍️ About the Author:
I’m Sunny, a full-stack developer passionate about secure software design, fintech systems, and Angular + FastAPI applications. Follow me for more posts on application security and modern fullstack development.