OWASP Injection Prevention Cheat Sheets

1. Injection Prevention

   General injection defense: parameterization, escaping and allow-lists.

2. SQL Injection Prevention

   Prepared statements, stored procedures and allow-list input validation.

3. Query Parameterization

   Parameterized query examples across languages.

4. OS Command Injection Defense

   Avoiding shell execution, argument separation and validation.

5. LDAP Injection Prevention

   Escaping LDAP filters and distinguished names.

6. XPath Injection Prevention

   Parameterized XPath queries.

7. XML External Entity Prevention

   Disabling DTDs and external entities in XML parsers.

8. Server-Side Template Injection Prevention

   Template sandboxing and logic-less templates.

9. NoSQL Security

   NoSQL injection and database hardening.

10. Injection Prevention in Java

    Java-specific injection defenses.

11. LLM Prompt Injection Prevention

    Defending LLM applications against prompt injection.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

• OWASP Dependency-Check
• OWASP Deserialization Cheat Sheet
• OWASP Django Security Cheat Sheets
• OWASP Docker Security Cheat Sheet
• OWASP File Upload Cheat Sheet
• OWASP GraphQL Cheat Sheet
• OWASP Input Validation Cheat Sheets
• OWASP Kubernetes Security Cheat Sheet
• OWASP Language and Framework Cheat Sheets
• OWASP Logging Cheat Sheets
• OWASP MASVS
• OWASP Node.js Security Cheat Sheets