What’s on the SQL Injection poster
The rule, 3 worked examples, and the mistake everyone makes.
- Never build a query by concatenating user input. Pass it as a parameter, always.
- BAD: "SELECT * FROM u WHERE n = '" + name + "'"
- name = "'; DROP TABLE u; --" = Two statements run
- The fix = WHERE n = ? with name passed separately
- ORMs = Safe by default, unsafe in raw mode
- Common mistake: Escaping quotes in the input yourself → Using parameterised queries
Table and column names cannot be parameterised. If they must be dynamic, validate against an allowlist.
Questions about the SQL Injection poster
- What’s on the SQL Injection poster?
- The rule, 3 worked examples, and the mistake everyone makes. Never build a query by concatenating user input. Pass it as a parameter, always.; BAD: "SELECT * FROM u WHERE n = '" + name + "'"; name = "'; DROP TABLE u; --" = Two statements run; The fix = WHERE n = ? with name passed separately; ORMs = Safe by default, unsafe in raw mode; Common mistake: Escaping quotes in the input yourself → Using parameterised queries. Table and column names cannot be parameterised. If they must be dynamic, validate against an allowlist.
- Who is the SQL Injection poster for?
- SQL Injection belongs to the Computing section rather than to a school year, because computing is not something one grade owns. Anyone learning security can pin it up — a beginner, a student mid-course, or someone revising years later.
- When should you use the SQL Injection poster?
- Parameterise. Escaping by hand looks like it works right up until it does not. A wall chart earns its place by being glanceable from where the work is happening, so SQL Injection belongs on the wall where that computing work actually happens, within glancing distance, rather than filed away.
- What other posters go with SQL Injection?
- Common Web Risks, Secrets and AuthN vs AuthZ sit alongside SQL Injection in the Computing section. Printed together they make a wall rather than a single sheet, which is how a reference set actually gets used.Common Web RisksSecretsAuthN vs AuthZ
- Is the SQL Injection poster free to download and print?
- Yes. SQL Injection downloads as a free PDF with no account, no email and no watermark, like everything else in the Computing section. Print as many copies as you like for a home, a classroom, a library or a tutoring group; reselling the file is the only thing the licence rules out.Read the licence
- What size does the SQL Injection poster print at?
- SQL Injection is a vector PDF laid out for US Letter, and prints on A4 with Fit to page — the same file, no separate download. Because every mark on it is drawn rather than photographed, it stays sharp enlarged to A3, A2 or A1 at a copy shop. Colour carries emphasis only, so a greyscale print of SQL Injection loses nothing.Printing guide
Related posters
Charts that sit alongside SQL Injection on the same wall.
Browse every Computing poster, or start from the full catalogue.