Query Security: Parameterisation, Least Privilege and Injection Defence

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

The database side view of injection: how parameterisation and prepared statements actually work, where Object Relational Mappers quietly leak the protection they are supposed to provide, how to build dynamic queries and stored procedures safely, and how to design least privilege database accounts that limit damage even when a query goes wrong. Cross-references the published Injection in Depth course rather than repeating it, and closes with detection and triage for this specific class of finding.

What you'll learn

Why the Database Side Is a Different View of Injection

Reframing Injection from the Database Side
Source, Sink and Sanitiser Vocabulary Applied to Application Accounts and Queries
What Least Privilege Means for a Database Connection

Parameterisation and Prepared Statements

How Parameterised Queries Actually Prevent Injection
Prepared Statement Lifecycle and Statement Caching
Where Parameterisation Cannot Reach: Identifiers, Sort Order and Batching

Object Relational Mappers and Where They Leak

What an Object Relational Mapper Buys You by Default
Raw Query Escape Hatches and Common Leak Points
Second-Order Risk: Eager Loading, Read-Then-Use and Stored Fragments

Dynamic Query Construction Done Safely

01Why the Database Side Is a Different View of Injection3 lessons

Reframing Injection from the Database Side
Source, Sink and Sanitiser Vocabulary Applied to Application Accounts and Queries
What Least Privilege Means for a Database Connection

02Parameterisation and Prepared Statements3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

When You Actually Need Dynamic SQL
Safe Patterns: Allowlisting Identifiers and Query Builders
Stored Procedures and Dynamic SQL Inside the Database

Least Privilege Account Design in Practice, and Detection

Least Privilege Account Design in Practice: Per-Service Roles, Connection Pooling and Credential Scope
Detecting Query Security Risk from the Database Side
False Positives, Triage and Where Safeguard Surfaces These Findings

How Parameterised Queries Actually Prevent Injection

Prepared Statement Lifecycle and Statement Caching

Where Parameterisation Cannot Reach: Identifiers, Sort Order and Batching

03Object Relational Mappers and Where They Leak3 lessons

What an Object Relational Mapper Buys You by Default
Raw Query Escape Hatches and Common Leak Points
Second-Order Risk: Eager Loading, Read-Then-Use and Stored Fragments

04Dynamic Query Construction Done Safely3 lessons

When You Actually Need Dynamic SQL
Safe Patterns: Allowlisting Identifiers and Query Builders
Stored Procedures and Dynamic SQL Inside the Database

05Least Privilege Account Design in Practice, and Detection3 lessons

Least Privilege Account Design in Practice: Per-Service Roles, Connection Pooling and Credential Scope
Detecting Query Security Risk from the Database Side
False Positives, Triage and Where Safeguard Surfaces These Findings2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.