API injection vulnerabilities arise when untrusted input is interpreted as executable logic in SQL, NoSQL, shell, template, or expression contexts. Attackers manipulate request fields to alter queries, execute commands, or bypass controls. Modern APIs remain vulnerable when dynamic query builders, unsafe string interpolation, or weak input contracts are used.
Use parameterized queries and safe APIs for all data access layers. Enforce strict schema validation and normalization before business logic execution. Avoid dynamic command construction, escape output contextually, and add focused security tests for injection payloads across query, command, and template boundaries.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2019Latest
#08api08-2019 Injection
