---
title: "Input and injection · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/input-and-injection
parts: 11
tokens_total: 9303
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1234
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Input and injection

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Application security](https://agentwranglers.se/playbook/application-security.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Keep data and code apart. Untrusted input must never become part of a query, a page, a shell command, a template, a file or a header.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/input-and-injection">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- APS-2 [Use parameterised queries](https://agentwranglers.se/playbook/application-security/input-and-injection/sql-injection.md) · 925 tokens · updated 2026-10-27
  Send every database query with placeholders, and pass user input as separate values. Never build a query by joining strings.
- APS-97 [Keep query operators out of document database input](https://agentwranglers.se/playbook/application-security/input-and-injection/nosql-injection.md) · 832 tokens · updated 2026-10-27
  Where a document database query expects a plain value, accept only that value. Reject request objects with keys that start with `$`, and never pass input to `$where` or server-side JavaScript.
- APS-3 [Escape everything you show](https://agentwranglers.se/playbook/application-security/input-and-injection/cross-site-scripting.md) · 1,264 tokens · updated 2026-10-27
  Escape untrusted text for the place it lands in a page, and back it up with a strict Content Security Policy.
- APS-4 [Never pass input to a shell](https://agentwranglers.se/playbook/application-security/input-and-injection/command-injection.md) · 858 tokens · updated 2026-10-27
  Run other programs without a shell, with input as separate arguments. Better still, use a library instead of a program.
- APS-5 [Keep input out of templates](https://agentwranglers.se/playbook/application-security/input-and-injection/template-injection.md) · 831 tokens · updated 2026-10-27
  Pass user input to a template as data. Never use it as the template itself.
- APS-7 [Turn off external entities in XML](https://agentwranglers.se/playbook/application-security/input-and-injection/xml-entities.md) · 777 tokens · updated 2026-10-27
  When the app parses XML, turn off external entities and document types in the parser, or accept JSON instead.
- APS-8 [Never rebuild objects from untrusted data](https://agentwranglers.se/playbook/application-security/input-and-injection/unsafe-deserialisation.md) · 753 tokens · updated 2026-10-27
  Read untrusted data only as plain data, such as JSON. Never use formats that can rebuild code objects.

## Recommended

- APS-6 [Strip line breaks from headers and logs](https://agentwranglers.se/playbook/application-security/input-and-injection/header-injection.md) · 659 tokens · updated 2026-10-27
  Remove or reject line breaks in any input that goes into a header, a redirect, an email header or a log line.
- APS-9 [Block prototype pollution](https://agentwranglers.se/playbook/application-security/input-and-injection/prototype-pollution.md) · 700 tokens · updated 2026-10-27
  In JavaScript, never merge or copy untrusted objects in a way that lets keys such as `__proto__` change every object in the app.
- APS-98 [Escape input in directory queries](https://agentwranglers.se/playbook/application-security/input-and-injection/ldap-injection.md) · 863 tokens · updated 2026-10-27
  Escape every value placed in an LDAP search filter or distinguished name with the library's escape function for that part. Never join raw input into a filter.
- APS-99 [Neutralise formulas in spreadsheet exports](https://agentwranglers.se/playbook/application-security/input-and-injection/csv-injection.md) · 841 tokens · updated 2026-10-27
  In every CSV or spreadsheet export, quote each field as RFC 4180 says. Put a single quote before any value that starts with `=`, `+`, `-`, `@`, a tab, a carriage return or a line feed. Treat the full-width signs `＝`, `＋`, `－` and `＠` the same way.

## Read this with

- [Data and databases playbook](https://agentwranglers.se/playbook/data.md). Every query built from user input is a target. Test each one for SQL injection.
- [Search playbook](https://agentwranglers.se/playbook/search.md). Escape every highlighted excerpt before you show it.

- Previous: [Threat modelling](https://agentwranglers.se/playbook/application-security/threat-modelling.md)
- Next: [Authentication and sessions](https://agentwranglers.se/playbook/application-security/authentication-and-sessions.md)
- [All chapters](https://agentwranglers.se/playbook/application-security.md)