# A05:2025 - Injection

> Hostile data sent to an interpreter to execute unintended commands.

- **Category**: Owasp Security
- **Subcategory**: top10_2025
- **Canonical URL**: https://designpattern.fyi/owasp_security/a05_injection/

---

## Description
'**Intent**: Prevent untrusted data from being interpreted as commands or queries by backend systems.

**Context**: Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query. SQL injection, OS command injection, and LDAP injection remain prevalent attack vectors.

**Solution**: Use parameterized queries and prepared statements. Validate and sanitize all user inputs. Use ORMs. Apply least privilege to database accounts. Implement input allowlisting where possible.'



## Use Cases
Use whenever user-supplied data interacts with interpreters, databases, operating systems, or external services.





## Trade-offs


### Advantages

- Prevents data theft and corruption

- Blocks command execution attacks

- Protects database integrity

- Reduces risk of system compromise




### Considerations & Drawbacks

- Requires consistent implementation across all inputs

- Legacy code may be difficult to retrofit

- Some injection vectors are subtle







---
**Reference**: [Original Source](https://owasp.org/Top10/2025)