The 10 most critical API security risks - Part 8: Injection 
Tags: api, owasp, security, apisecurity
Published: 2020-03-17 21:01:26


---
title: The 10 most critical API security risks - Part 8: Injection 
published: true
description: The recently published "OWASP API security top 10" report analyzes the anti-patterns that lead to vulnerabilities and security risks in APIs. In this 10 part series, we introduce these API anti-patterns. Every API professional should know about these anti-patterns. API
tags: API, owasp, Security, API Security
canonical_url: https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks-part-8-injection/
cover_image: 
series: API-University - OWASP API security risks
---

 The recently published *“OWASP API security top 10”* report analyzes the anti-patterns that lead to vulnerabilities and security risks in APIs. In this 10 part series, we introduce these API anti-patterns. Every API professional should know about these anti-patterns.

![](https://api-university.com/wp-content/uploads/2020/01/owasp-api-08-1024x399.png)
Injection from the [OWASP API security paper](https://github.com/OWASP/API-Security/raw/master/2019/en/dist/owasp-api-security-top-10.pdf)**API security anti-pattern for Injection**

Injection flaws, such as SQL, NoSQL, Command Injection, etc., occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s malicious data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

**Want to learn more?**

- [Part 1 Broken Object Level Authorization ](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-1:-broken-object-level-authorization)
- [Part 2 Broken User Authentication](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-2:-broken-user-authentication)
- [Part 3 Excessive Data Exposure](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-3:-excessive-data-exposure)
- [Part 4 Lack of Resources & Rate Limiting](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-4:-lack-of-resources-&-rate-limiting/)
- [Part 5 Broken Function Level Authorization](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-5:-broken-function-level-authorization)
- [Part 6 Mass Assignment](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-6:-mass-assignment)
- [Part 7 Security Misconfiguration](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-7:-security-misconfiguration)
- [Part 8 Injection](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-8:-injection)

Check out the complete [OWASP API security paper](https://github.com/OWASP/API-Security/raw/master/2019/en/dist/owasp-api-security-top-10.pdf). To secure access to your APIs, learn more about the OAuth in the [OAuth Book](https://api-university.com/books/oauth-2-0-book/), or the [OAuth Course](https://api-university.com/courses/oauth-2-0-course/). To provide and use identity data in apps and APIs, learn more about OpenID Connect in the [OpenID Connect Book](https://api-university.com/books/openid-connect/), or the [OpenID Connect Course](https://api-university.com/courses/openid-connect/).