How do I prevent SQL injection, NoSQL injection and SSRF?

Definition:

Injection occurs when untrusted data becomes part of a command's structure rather than remaining data. SSRF occurs when the server's network access is used to reach an unintended destination. These attacks bypass simple “is this input present?” checks because apparently valid strings or objects can still cause unauthorized behavior.

Key points:

• SQL: bind data as parameters and allowlist dynamic column names.

• NoSQL: accept expected types and fields; do not use a raw request object as a query.

• SSRF: restrict outbound hosts, ports, redirects and resolved IP addresses.

• Allowlist dynamic sort fields and query operators; parameter binding protects values, not arbitrary identifiers or permissions.

Interview point:

• Apply controls at execution boundaries—query construction and outbound connections—not only at form validation.