SQL Bind

Prepared statements and ORM binds — SQL output safety in YOUR repo, not sqlmap elsewhere.

SQL Bind• Audio Walkthrough

00:00/03:31

Visual · sql_bind

SQL parameter binding literacy. $MY_REPO only. Original Cyberlium.

Binding separates data from SQL syntax — the developer fix lives in $MY_REPO, not in stranger database consoles.

SQL Bind means using prepared statements with bound parameters so user input never concatenates into query text. ORMs expose safe query APIs; raw drivers offer prepare/bind calls. Cyberlium teaches refactoring one query in $TOY_APP — not sqlmap on live shop search or classmate APIs to 'prove' binding works. Encoding lesson reminder: SQL safety is parameterization, not HTML escaping in queries. Next: Encoding Lab.

1. Bind parameters, never concat

Bad: "SELECT * FROM users WHERE id=" + userId. Good: prepared statement with ? or named :id bind. Driver sends data separately from SQL structure.

On $MY_REPO, locate any remaining concat SQL from Module 3 and confirm bind usage with a local unit or integration test.

Command guide

Try these commands — Bind parameters, never concat

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: python3, grep. Reference sites: SQL bind (https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html); ORM safety (https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. ORM is not magic if you raw-query wrong

ORMs safe by default until you inject raw SQL strings. When raw SQL is required, still use binds. Document any exception with review note in lab repo.

Defenders watch for ORM escape hatches in code review — you practice the grep habit.

3. No sqlmap proof on strangers

Proving injection fix means green tests on localhost — not trophies from stranger URLs. sqlmap against others remains out of scope.

Ship: bind refactor confirmation + test note. Next: Encoding Lab.

4. What you ship: SQL bind confirmation for $TOY_APP

All user-driven SQL uses binds in $MY_REPO. Local test noted. NEVER sqlmap strangers. chmod 600.

5. What you record before the next lesson

Date. Bind refactor status. Test command output summary. File t17-m04-l03-sql-bind.txt chmod 600.

6. Wrong vs right: stranger apps vs YOUR repo

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: sqlmap live shop after 'adding bind.' Leave one concat query because ORM 'handles most.'
Right: Confirm parameterized SQL on $TOY_APP. Next: Encoding Lab.

Hands-on Exercise