# CD-SEC-08 - Injection Handling Failures

> Apps dynamically query data from user input without sanitization, often using platform-specific syntax.

- **Category**: Owasp Citizen Development
- **Subcategory**: top10
- **Canonical URL**: https://designpattern.fyi/patterns/cdsec08_injection_handling_failures/

---

## Description
'**Intent**: Prevent injection attacks through inadequate input sanitization in low-code/no-code platforms.

**Context**: Apps dynamically query data from user input without sanitization — a classic AppSec problem, made worse by the fact that LCNC platforms often have their own proprietary syntax for referencing internal data, which standard input-sanitization libraries don't know to account for.

**Solution**: Implement input sanitization that accounts for the specific operations performed on that input (SQL, platform-native syntax, macro execution, etc.). Use parameterized queries and stored procedures where possible. Platform vendors must sanitize their own proprietary syntax, not just standard injection vectors. Apply input validation and allowlisting.'



## Use Cases
Use when building low-code/no-code applications that process user input or query data using platform-specific syntax.





## Trade-offs


### Advantages

- Prevents injection attacks

- Protects against platform-specific vectors

- Enables data security

- Supports compliance requirements




### Considerations & Drawbacks

- Platform-specific sanitization complexity

- May require vendor cooperation

- Input validation maintenance







---
**Reference**: [Original Source](https://owasp.org/www-project-citizen-development-top10-security-risks/)