SQL Injection Explained: How Source, Sink, and Taint Define a Vulnerability

A software vulnerability typically follows a predictable pattern where untrusted user input travels from a source, such as an HTTP request parameter, to a dangerous sink, like a database query, without being sanitized first. Security researchers use the concept of 'taint' to describe how unvalidated data contaminates everything it touches on that path. Common web vulnerabilities including SQL injection, command injection, path traversal, and XSS all share this same source-to-sink structure, differing only in which dangerous operation is exploited. In a Java SQL injection example, one method passes user input directly into a DELETE query, allowing an attacker to wipe an entire database table by appending a condition like 'OR 1=1'. A second version of the method blocks the attack by validating that the input contains only digits before constructing the query, illustrating how input validation acts as a filter between source and sink.