How to Fix CWE-89: SQL Injection

Step-by-Step Remediation

1. Use parameterized queries (prepared statements) for ALL database interactions
2. Use an ORM (Sequelize, Prisma, SQLAlchemy) instead of raw SQL
3. Apply least-privilege database permissions
4. Validate and whitelist expected input formats
5. Enable WAF rules for SQL injection patterns

Code Example

# VULNERABLE: String concatenation
query = f"SELECT * FROM users WHERE id = {user_id}"

# SAFE: Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

Recent Vulnerabilities (CWE-89)

84 vulnerabilities in our database match SQL Injection.