Why should you care?

Search box sending '; DROP TABLE orders; -- destroys DataFlow if app builds string SQL and uses overpowered user.

See it live — copy this example

Run in MySQL Workbench or the mysql CLI.

-- UNSAFE (never):
-- "SELECT * FROM customers WHERE email = '" + req.body.email + "'"
-- SAFE:
SET @email = 'priya@dataflow.in';
PREPARE s FROM 'SELECT customer_id, full_name FROM customers WHERE email = ? LIMIT 1';
EXECUTE s USING @email;
DEALLOCATE PREPARE s;

What happened?

• Bound parameter treats malicious input as literal string — not executable DROP.
• Even if hacker sends email=' OR 1=1 --, query returns zero or one row safely.

Practice next

1. Audit one API route for string concat SQL.
2. Rewrite with ? placeholders in mysql2.
3. Try injection string in dev — verify no extra rows.
4. Test BOOLEAN MODE injection in FULLTEXT separately from params.
5. Enable WAF rule on API gateway as extra layer.

Remember

Parameters separate code from data. Whitelist dynamic identifiers. Limit DB user power.

DataFlow login form

Pen test finds injection in legacy endpoint — patched with prepared statements same day.

Outcome: Customer emails never leak via UNION attack.