Secure › Module 4 › Lesson 3
SQL Bind
Prepared statements and ORM binds — SQL output safety in YOUR repo, not sqlmap elsewhere.
Visual · sql_bind
SQL parameter binding literacy. $MY_REPO only. Original Cyberlium.
Opening
Binding separates data from SQL syntax — the developer fix lives in $MY_REPO, not in stranger database consoles.
SQL Bind means using prepared statements with bound parameters so user input never concatenates into query text. ORMs expose safe query APIs; raw drivers offer prepare/bind calls. Cyberlium teaches refactoring one query in $TOY_APP — not sqlmap on live shop search or classmate APIs to 'prove' binding works. Encoding lesson reminder: SQL safety is parameterization, not HTML escaping in queries. Next: Encoding Lab.
1. Bind parameters, never concat
Bad: "SELECT * FROM users WHERE id=" + userId. Good: prepared statement with ? or named :id bind. Driver sends data separately from SQL structure.
On $MY_REPO, locate any remaining concat SQL from Module 3 and confirm bind usage with a local unit or integration test.
Command guide
Try these commands — Bind parameters, never concat
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SQL bind — https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html ORM safety — https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Parameterized: never f-string SQL with user input')"
grep -rnE '\+.*SELECT|format\(.*SELECT' "$HOME/cyberlium-lab/t17-toy" 2>/dev/null | head -5 || echo 'No string-glue SQL in MY_REPO yet'Primary tools to practice this lesson: python3, grep. Reference sites: SQL bind (https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html); ORM safety (https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. ORM is not magic if you raw-query wrong
ORMs safe by default until you inject raw SQL strings. When raw SQL is required, still use binds. Document any exception with review note in lab repo.
Defenders watch for ORM escape hatches in code review — you practice the grep habit.
3. No sqlmap proof on strangers
Proving injection fix means green tests on localhost — not trophies from stranger URLs. sqlmap against others remains out of scope.
Ship: bind refactor confirmation + test note. Next: Encoding Lab.
4. What you ship: SQL bind confirmation for $TOY_APP
All user-driven SQL uses binds in $MY_REPO. Local test noted. NEVER sqlmap strangers. chmod 600.
5. What you record before the next lesson
Date. Bind refactor status. Test command output summary. File t17-m04-l03-sql-bind.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
sqlmap live shop after 'adding bind.' Leave one concat query because ORM 'handles most.'
Right
Confirm parameterized SQL on $TOY_APP. Next: Encoding Lab.
Mission: SQL bind audit
1) Grep $MY_REPO for concat SQL. 2) Refactor any remaining to prepared/bind. 3) Run local test. Never sqlmap apps you do not own.
Stuck? Ask Cyberlium AI Mentor
Log query structure without logging bind values that are secrets.
Knowledge Check
APPLY: SQL bind / prepared statements:
Multiple choice
Knowledge Check
APPLY: True or False: HTML encoding user input fixes SQL injection.
True or False
Knowledge Check
APPLY: Proving bind fix in Cyberlium means:
Multiple choice