Separation of Code and Data

web security

Definition

Separation of Code and Data

Separation of code and data is the principle that a value supplied as data must never be parsed as code by a downstream interpreter. Every web injection — command, code, SQL, NoSQL — shares one root cause: the server concatenates user input into a string that another engine (shell, eval, SQL parser, query-object builder) later parses. The attacker’s metacharacters become active because the boundary between data and code was never enforced.

The corresponding defences — prepared statements, allow-listing, avoiding eval and dynamic shell commands — all enforce that boundary by keeping user input out of the parsed instruction stream.