1 / 3
Trace entry points to consumers
Read the paths from values, structural choices, and upload entry points to their database or processing consumers.
Evidence to retain
Input origins mapped to values, structural choices, and stores.
Trace input into queries and file processing
Follow inputs from entry points to SQL construction and file storage or processing.
When to use this guide
Use this for features accepting external input, such as search, sorting, or file uploads.
Distinguish data handling from the code and configuration that determine structure or execution.
Where to start
2 / 3
Separate values from structure
Review SQL bindings and fixed structural choices, then examine execution permissions at upload destinations.
Evidence to retain
References showing database calls, permitted choices, and separation of storage from execution.
3 / 3
Review tested boundaries
Review existing rejection, format, size, and permission tests and record paths outside their coverage.
Evidence to retain
Input types, processing destinations, and existing test scope.
Apply the rules to your environment
Inspect external input and SQL construction →
Application-owned code builds SQL from search values and sort choices.
Read the path from input handling to the actual database call.
Restrict execution of uploaded files →
An application accepts files and stores, serves, or processes them.
Read the configuration from upload entry through storage and processing.
Read the source incidents
MOVEit: SQL injection exploited before disclosure →
A MOVEit Transfer SQL injection vulnerability was exploited before disclosure. Investigators observed web shells and data theft, requiring investigation alongside updates.
ConoHa WING: unauthorized access and impact →
Some hosted web-server areas were accessed and malicious programs installed; technical entry details are undisclosed. 426 hosting accounts are affected; separately stored membership, contract and payment information is reported unaffected.
Selected examples. Each record retains its evidence status, unknowns, and sources.
Connect terms to review questions
- Parameter binding
- Passing values separately from SQL structure. Structural choices such as column names and sort directions need a different control.
- Is input concatenated into SQL before the value is bound?
- Open the related inspection rule →
- Asset
- A service, store, or administrative identity included in the review. Record its owner and purpose as well as its name.
- Which environment and owner does this asset belong to?
- Open the related inspection rule →
Keep conclusions within the evidence
- Do not infer SQL flaws inside a closed product; use the vendor’s affected-version guidance.
- Do not send attack inputs or executable probes to unauthorized targets or production.
Review how input is handled where it is consumed, as well as at the entry point.
References and review dates
- OWASP: SQL Injection Prevention Cheat Sheet ↗
Parameterized Queries; Allow-List Input Validation
- OWASP: File Upload Cheat Sheet ↗
File Storage Location; Filesystem Permissions
Learning review 2026-11-12 · Catalog review 2026-11-09
Give this scope to your AI
Share these two rules and examples without expanding the scope. Checks without evidence remain unverified.
Open this inspection pack →Explore another scenario
Check what was actually deployed
Connect the running version with the external code executed on its way to deployment.
Follow login and the session after it
Review MFA coverage separately from the mechanisms that stop an authenticated session.
Review secret handling without opening values
Map exposure paths and the process for invalidating old credentials after replacement.
Review exposure and data that remains
Review storage exposure together with the handling of retired environments and data copies.
Keep user and organization data separated
Connect resource authorization with the boundaries controlling reuse of generated responses.
Separate the blast radius from recovery
Connect reachable resources with containment and restoration records.
Set AI boundaries before delegating a task
Review destinations, action authorization, and traceable records at the execution boundary.