---
title: "Injection · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/injection
updated: 2026-10-20
licence: "All rights reserved"
---

# Injection

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Keep data and code apart. Untrusted input must never become part of a query, a page, a shell command, a template or a header.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/injection`.

## Required

- [Use parameterised queries](https://agentwranglers.se/playbook/adversarial-testing/injection/sql-injection): Send every database query with placeholders, and pass user input as separate values. Never build a query by joining strings.
- [Escape everything you show](https://agentwranglers.se/playbook/adversarial-testing/injection/cross-site-scripting): Escape untrusted text for the place it lands in a page, and back it up with a strict Content Security Policy.
- [Never pass input to a shell](https://agentwranglers.se/playbook/adversarial-testing/injection/command-injection): Run other programs without a shell, with input as separate arguments. Better still, use a library instead of a program.
- [Keep input out of templates](https://agentwranglers.se/playbook/adversarial-testing/injection/template-injection): Pass user input to a template as data. Never use it as the template itself.
- [Strip line breaks from headers and logs](https://agentwranglers.se/playbook/adversarial-testing/injection/header-injection): Remove or reject line breaks in any input that goes into a header, a redirect, an email header or a log line.
- [Turn off external entities in XML](https://agentwranglers.se/playbook/adversarial-testing/injection/xml-entities): Parse XML with external entities and document types turned off, or accept JSON instead.
- [Never rebuild objects from untrusted data](https://agentwranglers.se/playbook/adversarial-testing/injection/unsafe-deserialisation): Read untrusted data only as plain data, such as JSON. Never use formats that can rebuild code objects.
- [Block prototype pollution](https://agentwranglers.se/playbook/adversarial-testing/injection/prototype-pollution): In JavaScript, never merge or copy untrusted objects in a way that lets keys such as `__proto__` change every object in the app.

- Previous: [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement)
- Next: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- [All chapters](https://agentwranglers.se/playbook/adversarial-testing)