SQL Injection & XSS, Explained

The two classic injection holes share one root cause - user input getting treated as code - and one cure: keep data as data. Learn the mental model, then how to close SQL injection with parameterized queries and XSS with context-aware output encoding.

1. The One Bug Underneath Both: Mixing Data with Code SQL injection and XSS are the same bug: user input gets handed to a machine that reads it as instructions instead of as plain data. The cure for both is to keep a clean line between data and code.
2. SQL Injection A query built by gluing strings together lets user input rewrite what the query does - reading, changing, or destroying data. The real fix is parameterized queries: hand the database the SQL and the values on separate channels so input is always treated as a value, never as SQL.
3. Cross-Site Scripting (XSS) Untrusted input rendered straight into a page is read by the browser as HTML and JavaScript, so it runs in other users' browsers - stealing sessions, defacing pages. The fix is context-aware output encoding (ideally an auto-escaping template engine), with a Content-Security-Policy as defense-in-depth.