# Preventing SQL Injections

DevFeed: [Preventing SQL Injections](<https://devfeed.tech/articles/preventing-sql-injections-34609.md>)

Original publisher: [Read original article](<https://tapoueh.org/blog/2018/11/preventing-sql-injections/>)

Author: Dimitri Fontaine PostgreSQL Major Contributor; Author

Published: 2018-11-10T14:40:01Z

Content type: tutorial

Language: en

Sources: [Dimitri Fontaine](<https://devfeed.tech/sources/dimitri-fontaine.md>)

Topics: [PostgreSQL](<https://devfeed.tech/topics/postgresql.md>), [Security](<https://devfeed.tech/topics/security.md>), [SQL](<https://devfeed.tech/topics/sql.md>)

Tags: [postgresql](<https://devfeed.tech/tags/postgresql.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [query](<https://devfeed.tech/tags/query.md>), [security](<https://devfeed.tech/tags/security.md>), [sql](<https://devfeed.tech/tags/sql.md>)

## AI overview

This tutorial explains how PostgreSQL helps prevent SQL injection by sending static SQL query text separately from dynamic arguments. It advises using driver parameterization, avoiding string concatenation, and considering server-side prepared statements.

## Source excerpt

An SQL Injection is a security breach, one made famous by the Exploits of a Mom xkcd comic episode in which we read about little Bobby Tables: PostgreSQL implements a protocol level facility to send the static SQL query text separately from its dynamic arguments. An SQL injection happens when the database server is mistakenly led to consider a dynamic argument of a query as part of the query text. Sending those parts as separate entities over the protocol means that SQL injection is no longer possible.