SQL Injection still remains a very popular vector attack on vulnerable applications that incorrectly make use of database drivers. Luckily, by using the Drupal 8 database abstraction layer, we go a long way toward ensuring protection against such vulnerabilities. All we have to do is use it correctly.

When it comes to Entity queries, there isn't much we can do wrong. However, when using the Database API directly, as we did in Chapter 8, The Database API, we have to pay attention.

Most of the time, vulnerabilities have to do with improper placeholder management. For example, we should never do things like this:

$database->query('SELECT column FROM {table} t WHERE t.name = ' . $variable);  

This is regardless of what $variable is—direct user input or otherwise. Because by using that direct concatenation, malicious users may inject their own instructions and complete the statement in a different way than intended. Instead, we should use code like we did in Chapter 8, The Database API:

$database->query("SELECT column FROM {table} t WHERE t.name = :name", [':name' => $variable]);  

In other words, use placeholders that will then be sanitized by the API to ensure that no characters are allowed to form malicious statements.

Drupal 8 comes with an additional security improvement when it comes to SQL injection vulnerabilities—single statement executions. Up until recently, the PHP PDO driver (which Drupal extended since Drupal 7) did not have a flag in place to inform MySQL to execute only a single statement at a time. Theoretically, vulnerabilities caused by appending multiple statements were possible (with one painful example of an attack that marked the Drupal community forever—SA-CORE-2014-005). However, this has been changed, and Drupal now sends this flag via PDO to the database engine to prevent multiple statements from being executed at once. So, we get this extra bit of protection.