Parameterized Queries

Kind: mechanism

Layer: Security Core

Record: architecture:parameterized-queries

Severity: mandatory

Scope: service, database, security

Canonical: Ontology

A mechanism that sends query text and values to the database separately, so values are never parsed as query syntax.

Listed in Architecture principles, after CSRF Protection and before Session Management.

Requires

• Query Parameter Binding

Reinforces

• Input Validation
• Secure by Default

Enables

• Injection-Safe Data Access

Conflicts with

• String-Concatenated SQL

In tension with

• Dynamic Query Flexibility

Tensions

• Parameterized Queries / Dynamic Query Flexibility

Violated by

• String-Concatenated SQL

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Linked from

• Security / Privacy / Compliance / Governance
• Security Privacy Compliance
• Severity levels
• The resolutions