Free tools Windows power users keep installed
One-click scans. No signup required.
Injection flaws reach far beyond SQL: untrusted input can change what a database query, operating-system command, directory filter, or expression interpreter does. “The other eight” is a headline device, not an OWASP-defined count. OWASP names overlapping examples rather than a definitive list of eight non-SQL types. The practical shift is to look for every place untrusted data reaches an interpreter—not just SQL calls.
What injection means beyond SQL
Injection happens when untrusted data reaches a component that interprets commands or query syntax, and the data changes what that component executes. The interpreter may be a database, an operating system, a directory service, or an expression engine. OWASP’s A05 Injection – OWASP Top 10:2025 lists SQL, NoSQL, OS command, ORM, LDAP, EL/OGNL, SOAP, XPath, and REST-based queries among its examples. Those labels overlap, and the list is representative—not a formal taxonomy with eight non-SQL entries.
As an Amazon Associate I earn from qualifying purchases.
The common security question is whether input stays data or becomes part of an instruction. The way to keep that boundary depends on the interpreter: SQL parameter binding is not a universal fix for commands, LDAP filters, XPath, or templates.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Which interpreters should you look for?
| Family | Where input can change behavior | Review focus |
|---|---|---|
| SQL | A database query | Check whether values are bound as parameters or concatenated into query text. Also inspect dynamic SQL inside stored procedures. |
| NoSQL and ORM | A database query or ORM search expression | Check whether untrusted values are incorporated into query syntax. Using an ORM does not automatically make concatenated query language safe. |
| OS command | An operating-system command | Trace input passed to command-execution APIs. OWASP illustrates an nslookup command built by concatenating a request parameter. |
| LDAP | A directory query or filter | Check whether input changes the structure or meaning of the LDAP filter. |
| EL/OGNL | An expression-language interpreter | Look for untrusted values evaluated as expressions rather than handled as plain data. |
| XPath, SOAP, and REST-based queries | XML-related or service query syntax | Trace input into query construction and assess whether it could affect data retrieval or access control. |
These are starting points, not a checklist that applies identically to every application. The relevant families depend on the interpreters, frameworks, and input flows your software actually uses. OWASP’s Injection Prevention Cheat Sheet covers a broader set of injection surfaces.
#1 Best Overall
How to look for injection paths in code
Start with data flow, not a generic list of payload strings. A search for SQL-related terms may help locate database code, but it will miss flaws in other interpreters and cannot establish whether a value is safely handled. Trace untrusted input from its entry point to the component that interprets it.
- Map input sources. Include parameters from URLs, headers, cookies, JSON, SOAP, and XML—not only form fields.
- Locate interpreters and query builders. Review code that constructs or evaluates database queries, directory filters, expressions, and operating-system commands.
- Trace values into those sinks. Determine whether each value is passed through a safe interface as data or assembled into instructions. Follow values across helper functions and framework layers where needed.
- Test the paths that matter. Combine source review with automated testing, including fuzzing where appropriate. OWASP notes that code examination can reveal injection flaws that are harder to discover through testing alone.
- Integrate checks into delivery. SAST, DAST, and IAST can help identify flaws in CI/CD workflows. Treat results as evidence to investigate, not proof that the application is free of injection.
OWASP’s 2025 Injection category reports 37 mapped CWEs, 1,404,249 total occurrences, and 62,445 total CVEs in its score table. Its explanatory text cites more than 30,000 CVEs associated with Cross-site Scripting and more than 14,000 with SQL Injection. These are figures from OWASP’s dataset and category framing, not a universal count of real-world flaws.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to prevent each class of injection
OWASP summarizes the core principle: “The best means to prevent injection requires keeping data separate from commands and queries.” Use a safe API that avoids interpretation where possible, or one that provides a parameterized interface for the interpreter involved.
For SQL
Use prepared statements so values are treated as data rather than query syntax. Stored procedures can also be safe when implemented without unsafe concatenation or dynamic SQL; a procedure name alone does not make its contents safe. Ordinary parameter binding generally cannot represent identifiers such as table names, column names, or sort directions. Where possible, redesign the query; otherwise, map the input to a finite allow-list of permitted choices. See OWASP’s SQL Injection Prevention Cheat Sheet.
Rank #3
For other interpreters
Use that interpreter’s safe parameterized interface or an API that avoids interpreting the input as syntax. Encoding and validation rules are context-specific: a technique appropriate for one query language does not automatically protect another. Escaping is interpreter-specific and easy to apply incorrectly, so it should not be treated as a universal substitute for separating data from instructions.
Limit the damage if a flaw remains
Give application and database accounts only the database and operating-system permissions needed for their functions. Least privilege does not remove an injection flaw, but it can limit the access and damage available after exploitation.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
