A single root cause runs through SQL injection, XSS, XXE, and directory traversal: **building structured data (a query, HTML, a file path) by concatenating strings that include user input.** "There's no excuse for SQL injections in this day and age. It happens when code bashes strings together to make queries." The fixes are all "stop concatenating": - **SQL** — use placeholders / prepared statements: `"... WHERE NAME = ?"` with `stmt.setString(1, name)`, never `"... NAME = '" + name + "'"`. Every SQL library supports this. - **HTML** — "look for an HTML generation library that automatically escapes everything and forces you to ask nicely to do unsafe things." - **XML** — XXE (XML external entity) injection lets a crafted DTD make the parser read `file:///etc/passwd` and leak it in an error response; "most XML parsers are vulnerable by default," so configure them safely (and "no, the answer is not to parse XML yourself with regular expressions!"). - **File paths** — directory traversal feeds `../` strings to escape a base directory and reach the password file, or (with uploads) overwrite arbitrary files. **Never build a path from a request filename**: store the client's filename as an opaque database field and generate your own random key for the real filename, so external input is never part of a filesystem path. The discipline generalizes: represent structure with a real builder/parameterized API that understands the grammar, so user data can only ever be *data*, never *syntax*. ## Cross-Domain Connections - [[Cheap Security Floor While Shipping Fast]] — a concrete practitioner's version of this note's SQL fix: using a parameterized-query library (PHP's PDO) specifically to close off injection "by construction rather than by discipline" - [[Prompt Injection Attack Surface in AI Agents]] — the LLM-era instance of this note's root cause: an agent processing untrusted document/email/web content can't distinguish embedded instructions from legitimate task context, the same structure-vs-data confusion that causes SQL/HTML/XML injection, just with natural language as the grammar instead of a formal one --- *Source: [[Release It Second Edition]] (Michael T. Nygard, Pragmatic Bookshelf 2018) — Ch 11 — Security*