{"id":12567,"date":"2026-10-06T09:35:51","date_gmt":"2026-10-06T12:35:51","guid":{"rendered":"https:\/\/www.flane.com.pa\/blog\/?p=12567"},"modified":"2026-10-06T18:57:12","modified_gmt":"2026-10-06T21:57:12","slug":"injecao-de-sql-prepared-statements","status":"publish","type":"post","link":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/","title":{"rendered":"SQL Injection em 2026: por que prepared statements continuam sendo a resposta"},"content":{"rendered":"<section class=\"l-section wpb_row height_small\"><div class=\"l-section-h i-cf\"><div class=\"g-cols vc_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><p><span data-contrast=\"none\">A SQL Injection foi descrita publicamente em 1998, e a corre\u00e7\u00e3o circula desde ent\u00e3o. Prepared statements, tamb\u00e9m chamados de consultas parametrizadas, enviam o comando e os dados ao banco em etapas separadas. Com isso, o que o usu\u00e1rio digita nunca vira parte do comando.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Mesmo assim, a falha continua aparecendo em c\u00f3digo novo. O motivo costuma ser o mesmo: a equipe confia na sanitiza\u00e7\u00e3o de entrada, no WAF ou no ORM e mant\u00e9m a concatena\u00e7\u00e3o de strings em algum ponto do sistema. Os tr\u00eas reduzem a exposi\u00e7\u00e3o. A causa permanece, e ela \u00e9 uma consulta montada com dado externo e entregue ao banco como se fosse c\u00f3digo.<\/span><\/p>\n<\/div><\/div><div class=\"g-cols wpb_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ul>\n<li>\n<h4><strong><a href=\"https:\/\/www.flane.com.pa\/pt\/artificial-intelligence\" target=\"_blank\" rel=\"noopener\">Fast Lane oferece treinamentos de Intelig\u00eancia Artificial e Machine Learning dos principais fabricantes<\/a><\/strong><\/h4>\n<\/li>\n<li>\n<h4><a href=\"https:\/\/www.flane.com.pa\/blog\/pt\/newsletter\/\" target=\"_blank\" rel=\"noopener\">Assine a newsletter da TechTalk e fique informado de tudo<\/a><\/h4>\n<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><\/div><\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 aria-level=\"2\"><b><span data-contrast=\"none\">Por que uma falha de 1998 continua no topo das listas<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"none\">A inje\u00e7\u00e3o segue como categoria do OWASP Top 10, e a SQL Injection tem identificador pr\u00f3prio no cat\u00e1logo de fraquezas de software, a CWE-89. Tr\u00eas fatores explicam a perman\u00eancia.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"none\">Concatenar \u00e9 o caminho mais curto.<\/span><\/b><span data-contrast=\"none\"> Montar a consulta com + ou interpola\u00e7\u00e3o funciona no primeiro teste e passa em todo caso de uso leg\u00edtimo. O defeito s\u00f3 aparece com entrada hostil.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"none\">O c\u00f3digo antigo continua em produ\u00e7\u00e3o.<\/span><\/b><span data-contrast=\"none\"> Sistemas escritos antes de a equipe adotar um padr\u00e3o de acesso a dados raramente s\u00e3o reescritos. Eles seguem expostos por APIs novas.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"none\">A consulta din\u00e2mica foge do padr\u00e3o.<\/span><\/b><span data-contrast=\"none\"> Relat\u00f3rios com filtros opcionais, ordena\u00e7\u00e3o escolhida pelo usu\u00e1rio e buscas avan\u00e7adas levam o desenvolvedor de volta \u00e0 montagem manual de SQL, mesmo em projeto que usa ORM.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"none\">Do lado do atacante, o custo de explorar \u00e9 baixo. Das 635 vulnerabilidades sob explora\u00e7\u00e3o ativa em 2025, 53,86% tinham prova de conceito p\u00fablica. O n\u00famero cobre todas as classes de falha, e a SQL Injection \u00e9 s\u00f3 uma delas. Ele mostra o padr\u00e3o: em mais da metade dos casos, o atacante parte de um roteiro pronto.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Na SQL Injection, esse roteiro \u00e9 ainda mais acess\u00edvel. A t\u00e9cnica est\u00e1 documentada, e ferramentas abertas como o sqlmap testam e exploram um par\u00e2metro vulner\u00e1vel de forma autom\u00e1tica.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><p><span data-contrast=\"none\">Para quem responde por risco, a leitura \u00e9 direta. A falha \u00e9 barata de explorar e barata de evitar no momento em que o c\u00f3digo \u00e9 escrito. O custo sobe quando ela \u00e9 descoberta em produ\u00e7\u00e3o.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"2\"><b><span data-contrast=\"none\">O que realmente acontece: dado sendo interpretado como comando<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"none\">O banco de dados recebe a consulta como texto e a analisa para decidir o que executar. Quando a aplica\u00e7\u00e3o monta esse texto juntando SQL fixo com entrada do usu\u00e1rio, o banco n\u00e3o tem como saber onde termina um e come\u00e7a o outro.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Considere uma tela de login que monta a consulta assim:<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<pre spellcheck=\"false\" data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\"><code class=\"language-python\">query = (\r\n    \"SELECT id, nome FROM usuarios \"\r\n    \"WHERE email = '\" + email + \"' AND senha_hash = '\" + senha_hash + \"'\"\r\n)\r\ncursor.execute(query)<\/code><\/pre>\n<\/div><\/div><div class=\"g-cols wpb_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ul>\n<li>\n<h4><strong><a href=\"https:\/\/www.flane.com.pa\/pt\/cyber-security\" target=\"_blank\" rel=\"noopener\">Torne-se um expert em Cyber Security com os treinamentos e certifica\u00e7\u00f5es que Fast Lane oferece\u00a0<\/a><\/strong><\/h4>\n<\/li>\n<li>\n<h4><a href=\"https:\/\/www.flane.com.pa\/blog\/pt\/newsletter\/\" target=\"_blank\" rel=\"noopener\">Assine a newsletter da TechTalk e fique informado de tudo.<\/a><\/h4>\n<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><\/div><\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><p data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\"><span data-contrast=\"none\" xml:lang=\"PT-BR\" lang=\"PT-BR\" class=\"TextRun SCXW123936381 BCX0\"><span class=\"NormalTextRun SCXW123936381 BCX0\">Com um e-mail comum, o resultado \u00e9 o esperado. Se o atacante digita <\/span><\/span><a class=\"Hyperlink SCXW123936381 BCX0\" href=\"mailto:ana@empresa.com\" target=\"_blank\" rel=\"noreferrer noopener\"><span data-contrast=\"none\" xml:lang=\"PT-BR\" lang=\"PT-BR\" class=\"TextRun Underlined SCXW123936381 BCX0\"><span class=\"NormalTextRun SCXW123936381 BCX0\" data-ccp-charstyle=\"Hyperlink\">ana@empresa.com<\/span><\/span><\/a><span data-contrast=\"none\" xml:lang=\"PT-BR\" lang=\"PT-BR\" class=\"TextRun SCXW123936381 BCX0\"><span class=\"NormalTextRun SCXW123936381 BCX0\">&#8216; &#8212; no campo de e-mail, o banco recebe:<\/span><\/span><span class=\"EOP Selected SCXW123936381 BCX0\" data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<pre spellcheck=\"false\" data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\"><code class=\"language-sql\">SELECT id, nome FROM usuarios\r\nWHERE email = 'ana@empresa.com' -- ' AND senha_hash = '...'\r\n<\/code><\/pre>\n<p><span data-contrast=\"none\">A aspa simples fechou o literal antes da hora. O &#8212; abriu um coment\u00e1rio e descartou a verifica\u00e7\u00e3o de senha. O atacante entra como Ana sem conhecer a senha dela.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\"><\/span><\/p>\n<p><span data-contrast=\"none\">O mesmo mecanismo vai al\u00e9m do login. Com UNION SELECT, o atacante l\u00ea outras tabelas. Com consultas empilhadas, onde o driver permite, ele altera ou apaga dados. O alcance depende das permiss\u00f5es da conta que a aplica\u00e7\u00e3o usa para se conectar ao banco.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">A defini\u00e7\u00e3o da falha cabe em uma linha: um dado foi interpretado como comando. A defesa que resolve atua exatamente nesse ponto.<\/span><\/p>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 aria-level=\"2\"><b><span data-contrast=\"none\">Por que lista de bloqueio e escape manual falham<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"none\">As duas abordagens mant\u00eam a concatena\u00e7\u00e3o e tentam tornar o dado inofensivo antes de junt\u00e1-lo ao SQL. Ambas dependem de prever como o analisador do banco vai ler a string final.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"3\"><b><span data-contrast=\"none\">Lista de bloqueio<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Um filtro que rejeita ou remove SELECT, UNION, &#8212; e aspas cai diante de varia\u00e7\u00f5es que o banco aceita e o filtro n\u00e3o previu.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<table data-tablestyle=\"MsoNormalTable\" data-tablelook=\"1696\" aria-rowcount=\"5\" aria-colcount=\"3\">\n<tbody>\n<tr aria-rowindex=\"1\">\n<td data-celllook=\"0\"><b><span data-contrast=\"none\">Filtro aplicado<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335551550&quot;:2,&quot;335551620&quot;:2,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><b><span data-contrast=\"none\">Entrada que passa<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335551550&quot;:2,&quot;335551620&quot;:2,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><b><span data-contrast=\"none\">Por que passa<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335551550&quot;:2,&quot;335551620&quot;:2,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"2\">\n<td data-celllook=\"0\"><span data-contrast=\"none\">Bloqueia UNION SELECT em mai\u00fasculas<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"none\">uNiOn sElEcT<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"none\">Palavras-chave de SQL n\u00e3o diferenciam mai\u00fasculas de min\u00fasculas<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"3\">\n<td data-celllook=\"0\"><span data-contrast=\"none\">Bloqueia UNION SELECT com espa\u00e7o<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"none\">UNION\/**\/SELECT<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"none\">Um coment\u00e1rio vazio funciona como separador<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"4\">\n<td data-celllook=\"0\"><span data-contrast=\"none\">Remove a palavra SELECT uma vez<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"none\">SELSELECTECT<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"none\">A remo\u00e7\u00e3o do trecho central reconstr\u00f3i a palavra<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<tr aria-rowindex=\"5\">\n<td data-celllook=\"0\"><span data-contrast=\"none\">Bloqueia aspas simples<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"none\">1 OR 1=1 em campo num\u00e9rico<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<td data-celllook=\"0\"><span data-contrast=\"none\">Campo num\u00e9rico dispensa aspas<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span data-contrast=\"none\">A lista tamb\u00e9m gera falso positivo. Sobrenomes como O&#8217;Connor e D&#8217;\u00c1vila cont\u00eam aspa simples. Um campo de coment\u00e1rio pode conter a palavra &#8220;select&#8221;. Bloquear essas entradas quebra o uso leg\u00edtimo e deixa a falha aberta.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3 id=\"por-que-lista-de-bloqueio-e-escape-manual-falham\"><\/h3>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h4 aria-level=\"3\"><b><span data-contrast=\"none\">Escape manual<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Escapar aspas antes de concatenar resolve o caso mais simples e deixa outros abertos.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"none\">Contexto num\u00e9rico.<\/span><\/b><span data-contrast=\"none\"> Em &#8220;WHERE id = &#8221; + id, n\u00e3o h\u00e1 aspa para escapar. A entrada 1 OR 1=1 devolve a tabela inteira.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"none\">Conjunto de caracteres.<\/span><\/b><span data-contrast=\"none\"> Em algumas codifica\u00e7\u00f5es multibyte, o byte da barra de escape \u00e9 absorvido pelo caractere anterior, e a aspa volta a valer como delimitador.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"none\">Segunda ordem.<\/span><\/b><span data-contrast=\"none\"> O dado \u00e9 escapado na grava\u00e7\u00e3o e armazenado em sua forma original. Mais tarde, outro trecho de c\u00f3digo o concatena em uma nova consulta, tratando-o como confi\u00e1vel porque veio do pr\u00f3prio banco.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"none\">Identificadores.<\/span><\/b><span data-contrast=\"none\"> Nome de coluna em ORDER BY n\u00e3o fica entre aspas de literal. A fun\u00e7\u00e3o de escape de strings n\u00e3o se aplica.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"none\">O guia de preven\u00e7\u00e3o de SQL Injection da OWASP desaconselha o escape de entrada como defesa. Validar o formato continua valendo como higiene: e-mail com estrutura de e-mail, identificador num\u00e9rico s\u00f3 com d\u00edgitos. Isso reduz a superf\u00edcie, mas a consulta ainda precisa ser parametrizada.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"2\"><b><span data-contrast=\"none\">Consultas parametrizadas: separar c\u00f3digo de dado, na origem<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"none\">A consulta parametrizada, ou prepared statement, \u00e9 a defesa prim\u00e1ria contra SQL Injection. Ela muda a forma como a consulta chega ao banco. Primeiro vai o comando, com marcadores no lugar dos valores, e o banco analisa esse texto e fixa a estrutura. Depois v\u00e3o os valores, que s\u00f3 podem ocupar o lugar de valores.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Em Python, com o driver do banco:<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<\/div><\/div><div class=\"g-cols wpb_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ul>\n<li>\n<h4><strong><a href=\"https:\/\/www.flane.com.pa\/pt\/datacenter\" target=\"_blank\" rel=\"noopener\">Quer ser um expert em Data Center? Confira o portf\u00f3lio de treinamentos e certifica\u00e7\u00f5es da Fast Lane\u00a0<\/a><\/strong><\/h4>\n<\/li>\n<li>\n<h4><a href=\"https:\/\/www.flane.com.pa\/blog\/pt\/newsletter\/\" target=\"_blank\" rel=\"noopener\">Assine a newsletter da TechTalk e fique informado de tudo.<\/a><\/h4>\n<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><\/div><\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><pre spellcheck=\"false\" data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\"><code class=\"language-python\">cursor.execute(\r\n    \"SELECT id, nome FROM usuarios WHERE email = %s AND senha_hash = %s\",\r\n    (email, senha_hash),\r\n)<\/code><\/pre>\n<p data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\">Em Java, com JDBC:<\/p>\n<pre spellcheck=\"false\" data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\"><code class=\"language-java\">PreparedStatement ps = conn.prepareStatement(\r\n    \"SELECT id, nome FROM usuarios WHERE email = ? AND senha_hash = ?\");\r\nps.setString(1, email);\r\nps.setString(2, senhaHash);\r\nResultSet rs = ps.executeQuery();<\/code><\/pre>\n<p data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\">Com a entrada <code spellcheck=\"false\">ana@empresa.com' -- <\/code>, o banco procura um usu\u00e1rio cujo e-mail seja literalmente esse texto, com aspa e tra\u00e7os. N\u00e3o encontra, e o login falha. A aspa perdeu o significado sint\u00e1tico porque a an\u00e1lise do comando terminou antes de o dado chegar.<\/p>\n<p>Um detalhe do exemplo em Python merece aten\u00e7\u00e3o. Os valores v\u00e3o como segundo argumento de <code spellcheck=\"false\">execute<\/code>. Escrever <code spellcheck=\"false\">\"... email = '%s'\" % email<\/code> usa a formata\u00e7\u00e3o de strings da linguagem e devolve o c\u00f3digo \u00e0 concatena\u00e7\u00e3o.<\/p>\n<\/div><\/div><div class=\"g-cols wpb_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ul>\n<li>\n<h4><strong><a href=\"https:\/\/www.flane.com.pa\/pt\/cloud-training\" target=\"_blank\" rel=\"noopener\">Treinamentos e Certificados oficiais das principais nuvens do mercado? A Fast Lane tem tudo para voc\u00ea e seu time.<\/a><\/strong><\/h4>\n<\/li>\n<li>\n<h4><a href=\"https:\/\/www.flane.com.pa\/blog\/pt\/newsletter\/\" target=\"_blank\" rel=\"noopener\">Assine a newsletter da TechTalk e fique informado de tudo.<\/a><\/h4>\n<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><\/div><\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 id=\"o-que-o-marcador-n\u00e3o-cobre\" data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\">O que o marcador n\u00e3o cobre<\/h3>\n<p>Marcadores substituem valores. Nome de tabela, nome de coluna, dire\u00e7\u00e3o de ordena\u00e7\u00e3o e palavras-chave n\u00e3o podem ser parametrizados. Para esses casos, a aplica\u00e7\u00e3o escolhe entre op\u00e7\u00f5es fixas no c\u00f3digo:<\/p>\n<pre spellcheck=\"false\"><code class=\"language-python\">COLUNAS_ORDENAVEIS = {\"nome\": \"nome\", \"data\": \"criado_em\"}\r\ncoluna = COLUNAS_ORDENAVEIS.get(parametro_ordem, \"nome\")\r\nquery = f\"SELECT id, nome FROM clientes ORDER BY {coluna}\"<\/code><\/pre>\n<p>O usu\u00e1rio escolhe uma chave. O texto que entra no SQL sai do dicion\u00e1rio, escrito pelo desenvolvedor.<\/p>\n<p>Outros dois cuidados:<\/p>\n<ul>\n<li>Stored procedure s\u00f3 protege se n\u00e3o montar SQL din\u00e2mico por concatena\u00e7\u00e3o dentro dela.<\/li>\n<li>Cl\u00e1usula <code spellcheck=\"false\">IN<\/code> com lista vari\u00e1vel pede um marcador por item, gerado pelo c\u00f3digo. Juntar os valores com v\u00edrgula em uma string reabre a falha.<\/li>\n<\/ul>\n<h3 id=\"onde-o-orm-ainda-deixa-passar\">Onde o ORM ainda deixa passar<\/h3>\n<p>ORMs geram consultas parametrizadas por padr\u00e3o. Enquanto o c\u00f3digo usa a API de objetos, a prote\u00e7\u00e3o vem junto. A falha volta nos pontos em que o framework aceita SQL escrito \u00e0 m\u00e3o.<\/p>\n<p><strong>Raw query.<\/strong> Todo ORM tem uma sa\u00edda para SQL direto: <code spellcheck=\"false\">raw()<\/code> e <code spellcheck=\"false\">extra()<\/code> no Django, <code spellcheck=\"false\">text()<\/code> no SQLAlchemy, <code spellcheck=\"false\">createNativeQuery()<\/code> no Hibernate, <code spellcheck=\"false\">FromSqlRaw()<\/code> no Entity Framework, <code spellcheck=\"false\">sequelize.query()<\/code> no Sequelize. Essas fun\u00e7\u00f5es aceitam par\u00e2metros, mas tamb\u00e9m aceitam uma string j\u00e1 montada.<\/p>\n<pre spellcheck=\"false\"><code class=\"language-python\"># Vulner\u00e1vel: interpola\u00e7\u00e3o dentro de raw()\r\nCliente.objects.raw(f\"SELECT * FROM clientes WHERE nome = '{nome}'\")\r\n\r\n# Correto: valor passado como par\u00e2metro\r\nCliente.objects.raw(\"SELECT * FROM clientes WHERE nome = %s\", [nome])<\/code><\/pre>\n<p><strong>Concatena\u00e7\u00e3o din\u00e2mica na linguagem do ORM.<\/strong> HQL e JPQL tamb\u00e9m passam por um analisador. Montar <code spellcheck=\"false\">\"FROM Pedido WHERE status = '\" + status + \"'\"<\/code> cria a mesma falha uma camada acima.<\/p>\n<p><strong>Fragmentos em query builders.<\/strong> M\u00e9todos como <code spellcheck=\"false\">whereRaw()<\/code>, <code spellcheck=\"false\">orderByRaw()<\/code> e <code spellcheck=\"false\">literal()<\/code> inserem texto direto no SQL gerado. Eles costumam aparecer em filtros opcionais e em ordena\u00e7\u00e3o configur\u00e1vel.<\/p>\n<p>Em uma reuni\u00e3o de risco, &#8220;usamos ORM&#8221; descreve o padr\u00e3o do projeto e diz pouco sobre as exce\u00e7\u00f5es. A informa\u00e7\u00e3o que falta \u00e9 quantas raw queries existem no reposit\u00f3rio e quem revisa cada uma.<\/p>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 id=\"waf-como-camada-n\u00e3o-como-corre\u00e7\u00e3o\" data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\">WAF como camada, n\u00e3o como corre\u00e7\u00e3o<\/h3>\n<p>O WAF inspeciona a requisi\u00e7\u00e3o HTTP e a compara com assinaturas e padr\u00f5es de ataque. Ele n\u00e3o v\u00ea como a aplica\u00e7\u00e3o monta a consulta. Por isso, herda as limita\u00e7\u00f5es de uma lista de bloqueio:<\/p>\n<ul>\n<li>Varia\u00e7\u00f5es de codifica\u00e7\u00e3o, coment\u00e1rios e sintaxe menos comum do banco podem n\u00e3o casar com nenhuma assinatura.<\/li>\n<li>Tr\u00e1fego que n\u00e3o passa por ele fica sem inspe\u00e7\u00e3o: chamadas entre servi\u00e7os internos, jobs em lote, integra\u00e7\u00f5es diretas com parceiros.<\/li>\n<li>A inje\u00e7\u00e3o de segunda ordem dispara em uma consulta posterior, quando a requisi\u00e7\u00e3o do momento n\u00e3o carrega payload algum.<\/li>\n<\/ul>\n<p>Ainda assim, o WAF tem tr\u00eas usos leg\u00edtimos nesse cen\u00e1rio. Ele serve como corre\u00e7\u00e3o virtual enquanto o ajuste no c\u00f3digo passa por teste e deploy. Reduz o volume de varredura automatizada que chega \u00e0 aplica\u00e7\u00e3o. Al\u00e9m disso, gera telemetria para o SOC sobre quem est\u00e1 testando quais par\u00e2metros.<\/p>\n<p>O cuidado est\u00e1 no registro. Uma regra de WAF que bloqueia a explora\u00e7\u00e3o deixa a vulnerabilidade no c\u00f3digo. O item continua aberto no backlog, com dono e prazo, at\u00e9 a consulta ser parametrizada.<\/p>\n<p>A mesma l\u00f3gica vale para a outra camada que limita o dano: a conta de banco da aplica\u00e7\u00e3o. Ela deve operar com o menor privil\u00e9gio poss\u00edvel, sem permiss\u00e3o de DDL e sem acesso a esquemas que a aplica\u00e7\u00e3o n\u00e3o usa.<\/p>\n<\/div><\/div><div class=\"g-cols wpb_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ul>\n<li>\n<h4><strong><a href=\"https:\/\/www.flane.com.pa\/pt\/software-development\" target=\"_blank\" rel=\"noopener\">Quer aprender a desenvolver softwares? A Fast Lane oferece um portf\u00f3lio de treinamentos e certifica\u00e7\u00f5es l\u00edder de mercado. Confira aqui.<\/a><\/strong><\/h4>\n<\/li>\n<li>\n<h4><a href=\"https:\/\/www.flane.com.pa\/blog\/pt\/newsletter\/\" target=\"_blank\" rel=\"noopener\">Assine a newsletter da TechTalk e fique informado de tudo.<\/a><\/h4>\n<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><\/div><\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 id=\"checklist-de-code-review-para-appsec\" data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 3 &#091;&#093;\">Checklist de code review para AppSec<\/h3>\n<p>A lista abaixo cabe em um template de pull request. Cada item tem resposta de sim ou n\u00e3o.<\/p>\n<ul data-kind=\"check\">\n<li data-checked=\"false\">Nenhuma consulta monta SQL com concatena\u00e7\u00e3o, interpola\u00e7\u00e3o ou formata\u00e7\u00e3o de string a partir de dado externo. Busque <code spellcheck=\"false\">+<\/code>, f-string, <code spellcheck=\"false\">String.format<\/code> e <code spellcheck=\"false\">${}<\/code> perto de <code spellcheck=\"false\">SELECT<\/code>, <code spellcheck=\"false\">INSERT<\/code>, <code spellcheck=\"false\">UPDATE<\/code>, <code spellcheck=\"false\">DELETE<\/code> e <code spellcheck=\"false\">WHERE<\/code>.<\/li>\n<li data-checked=\"false\">Todo valor chega ao banco por marcador. O driver recebe o comando e os par\u00e2metros em argumentos separados.<\/li>\n<li data-checked=\"false\">Toda raw query do ORM est\u00e1 listada e justificada. Busque <code spellcheck=\"false\">raw(<\/code>, <code spellcheck=\"false\">text(<\/code>, <code spellcheck=\"false\">FromSqlRaw<\/code>, <code spellcheck=\"false\">createNativeQuery<\/code>, <code spellcheck=\"false\">whereRaw<\/code>, <code spellcheck=\"false\">orderByRaw<\/code> e <code spellcheck=\"false\">literal(<\/code>.<\/li>\n<li data-checked=\"false\">Nome de tabela, nome de coluna e dire\u00e7\u00e3o de ordena\u00e7\u00e3o saem de uma lista de permiss\u00e3o fixa no c\u00f3digo.<\/li>\n<li data-checked=\"false\">Consultas em HQL ou JPQL usam par\u00e2metros nomeados, sem concatena\u00e7\u00e3o.<\/li>\n<li data-checked=\"false\">Nenhuma stored procedure monta SQL din\u00e2mico por concatena\u00e7\u00e3o.<\/li>\n<li data-checked=\"false\">Dado lido do banco \u00e9 tratado como n\u00e3o confi\u00e1vel quando volta para outra consulta.<\/li>\n<li data-checked=\"false\">Cl\u00e1usulas <code spellcheck=\"false\">IN<\/code> com lista vari\u00e1vel geram um marcador por item.<\/li>\n<li data-checked=\"false\">A conta de banco da aplica\u00e7\u00e3o n\u00e3o tem permiss\u00e3o de DDL nem acesso a esquemas de outros sistemas.<\/li>\n<li data-checked=\"false\">Mensagens de erro do banco n\u00e3o chegam ao cliente.<\/li>\n<li data-checked=\"false\">O pipeline tem regra de an\u00e1lise est\u00e1tica para SQL concatenado, e ela bloqueia o merge.<\/li>\n<li data-checked=\"false\">Toda regra de WAF usada como corre\u00e7\u00e3o virtual tem um ticket de corre\u00e7\u00e3o no c\u00f3digo, com dono e prazo.<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 id=\"na-pr\u00e1tica\" data-lfile-container=\"e5ca1208-a610-4325-9045-cdb9edb62c0b\" data-pm-slice=\"1 1 &#091;&#093;\">Na pr\u00e1tica<\/h3>\n<p>Sanitiza\u00e7\u00e3o, WAF e ORM diminuem a chance de explora\u00e7\u00e3o. A consulta parametrizada remove a condi\u00e7\u00e3o que torna a explora\u00e7\u00e3o poss\u00edvel. Em qualquer revis\u00e3o de c\u00f3digo que toque o banco, a verifica\u00e7\u00e3o \u00e9 uma s\u00f3: se algum dado externo chega ao SQL por um caminho que n\u00e3o seja um par\u00e2metro.<\/p>\n<h3 id=\"participe-do-cybersprint\">Participe do CyberSprint<\/h3>\n<p>Secure coding \u00e9 um dos temas do CyberSprint, o game que n\u00f3s, da Fast Lane, promovemos no m\u00eas da ciberseguran\u00e7a. Participe, responda uma pergunta por dia e concorra a um drone DJI Mini 4K. A pontua\u00e7\u00e3o combina acerto e tempo de resposta.<\/p>\n<p>[INSERIR LINK DE CADASTRO DO CYBERSPRINT]<\/p>\n<p><em>Fonte: Relat\u00f3rio do Cen\u00e1rio Global de Amea\u00e7as 2026, FortiGuard Labs \/ Fortinet, 2026.<\/em><\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section><section class=\"l-section wpb_row height_small\"><div class=\"l-section-h i-cf\"><div class=\"g-cols vc_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><\/div><\/div><\/div><\/div><\/div><\/section>\n","protected":false},"excerpt":{"rendered":"A SQL Injection foi descrita publicamente em 1998, e a corre\u00e7\u00e3o circula desde ent\u00e3o. Prepared statements, tamb\u00e9m chamados de consultas parametrizadas, enviam o comando e os dados ao banco em etapas separadas. Com isso, o que o usu\u00e1rio digita nunca vira parte do comando.\u00a0 Mesmo assim, a falha continua aparecendo em c\u00f3digo novo. O motivo...","protected":false},"author":15,"featured_media":12573,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1872,1874,1926,1],"tags":[6291,6402,6396,6295,6392,6400,6394,6398],"class_list":["post-12567","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-pt","category-devops-pt","category-fastlane-pt","category-uncategorized","tag-appsec-pt","tag-code-review","tag-consultas-parametrizadas","tag-cybersprint-pt","tag-injecao-de-sql","tag-owasp","tag-prepared-statements","tag-secure-coding"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>SQL Injection em 2026: por que prepared statements resolvem<\/title>\n<meta name=\"description\" content=\"Sanitiza\u00e7\u00e3o, WAF e ORM reduzem o risco de inje\u00e7\u00e3o de SQL, mas s\u00f3 a consulta parametrizada separa c\u00f3digo de dado. Veja exemplos e um checklist de code review.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SQL Injection em 2026: por que prepared statements resolvem\" \/>\n<meta property=\"og:description\" content=\"Sanitiza\u00e7\u00e3o, WAF e ORM reduzem o risco de inje\u00e7\u00e3o de SQL, mas s\u00f3 a consulta parametrizada separa c\u00f3digo de dado. Veja exemplos e um checklist de code review.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/\" \/>\n<meta property=\"og:site_name\" content=\"TechTalk powered by Fast Lane LATAM\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/FastLane.br\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-06T12:35:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-06T21:57:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mayara Pimentel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@FastLaneBr\" \/>\n<meta name=\"twitter:site\" content=\"@FastLaneBr\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mayara Pimentel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/\"},\"author\":{\"name\":\"Mayara Pimentel\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#\\\/schema\\\/person\\\/137dd93330c10cbd683159ae4b4ff9c4\"},\"headline\":\"SQL Injection em 2026: por que prepared statements continuam sendo a resposta\",\"datePublished\":\"2026-10-06T12:35:51+00:00\",\"dateModified\":\"2026-10-06T21:57:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/\"},\"wordCount\":2311,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg\",\"keywords\":[\"AppSec\",\"code review\",\"consultas parametrizadas\",\"CyberSprint\",\"inje\u00e7\u00e3o de SQL\",\"OWASP\",\"prepared statements\",\"secure coding\"],\"articleSection\":[\"Cyber Security\",\"DevOps\",\"Fast Lane\",\"Uncategorized\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/\",\"name\":\"SQL Injection em 2026: por que prepared statements resolvem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg\",\"datePublished\":\"2026-10-06T12:35:51+00:00\",\"dateModified\":\"2026-10-06T21:57:12+00:00\",\"description\":\"Sanitiza\u00e7\u00e3o, WAF e ORM reduzem o risco de inje\u00e7\u00e3o de SQL, mas s\u00f3 a consulta parametrizada separa c\u00f3digo de dado. Veja exemplos e um checklist de code review.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg\",\"contentUrl\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg\",\"width\":1280,\"height\":720,\"caption\":\"Desenvolvedor digitando c\u00f3digo em um notebook, com um segundo monitor exibindo c\u00f3digo ao fundo, representando a revis\u00e3o de consultas ao banco de dados para prevenir inje\u00e7\u00e3o de SQL com prepared statements.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/injecao-de-sql-prepared-statements\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SQL Injection em 2026: por que prepared statements continuam sendo a resposta\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/\",\"name\":\"TechTalk powered by Fast Lane LATAM\",\"description\":\"Sharing ideas and knowledge on IT training and certification\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#organization\",\"name\":\"Fast Lane Brasil\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/fast-lane-ng3.png\",\"contentUrl\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/fast-lane-ng3.png\",\"width\":209,\"height\":31,\"caption\":\"Fast Lane Brasil\"},\"image\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/FastLane.br\",\"https:\\\/\\\/x.com\\\/FastLaneBr\",\"https:\\\/\\\/www.instagram.com\\\/fastlane.br\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/fastlanebr\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#\\\/schema\\\/person\\\/137dd93330c10cbd683159ae4b4ff9c4\",\"name\":\"Mayara Pimentel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g\",\"caption\":\"Mayara Pimentel\"},\"sameAs\":[\"https:\\\/\\\/www.instagram.com\\\/mayara.piimentel\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/mayara-pimentel\\\/\"],\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/author\\\/mayarap\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SQL Injection em 2026: por que prepared statements resolvem","description":"Sanitiza\u00e7\u00e3o, WAF e ORM reduzem o risco de inje\u00e7\u00e3o de SQL, mas s\u00f3 a consulta parametrizada separa c\u00f3digo de dado. Veja exemplos e um checklist de code review.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/","og_locale":"pt_BR","og_type":"article","og_title":"SQL Injection em 2026: por que prepared statements resolvem","og_description":"Sanitiza\u00e7\u00e3o, WAF e ORM reduzem o risco de inje\u00e7\u00e3o de SQL, mas s\u00f3 a consulta parametrizada separa c\u00f3digo de dado. Veja exemplos e um checklist de code review.","og_url":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/","og_site_name":"TechTalk powered by Fast Lane LATAM","article_publisher":"https:\/\/www.facebook.com\/FastLane.br","article_published_time":"2026-10-06T12:35:51+00:00","article_modified_time":"2026-10-06T21:57:12+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg","type":"image\/jpeg"}],"author":"Mayara Pimentel","twitter_card":"summary_large_image","twitter_creator":"@FastLaneBr","twitter_site":"@FastLaneBr","twitter_misc":{"Escrito por":"Mayara Pimentel","Est. tempo de leitura":"11 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/#article","isPartOf":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/"},"author":{"name":"Mayara Pimentel","@id":"https:\/\/www.flane.com.pa\/blog\/#\/schema\/person\/137dd93330c10cbd683159ae4b4ff9c4"},"headline":"SQL Injection em 2026: por que prepared statements continuam sendo a resposta","datePublished":"2026-10-06T12:35:51+00:00","dateModified":"2026-10-06T21:57:12+00:00","mainEntityOfPage":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/"},"wordCount":2311,"commentCount":0,"publisher":{"@id":"https:\/\/www.flane.com.pa\/blog\/#organization"},"image":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/#primaryimage"},"thumbnailUrl":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg","keywords":["AppSec","code review","consultas parametrizadas","CyberSprint","inje\u00e7\u00e3o de SQL","OWASP","prepared statements","secure coding"],"articleSection":["Cyber Security","DevOps","Fast Lane","Uncategorized"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/","url":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/","name":"SQL Injection em 2026: por que prepared statements resolvem","isPartOf":{"@id":"https:\/\/www.flane.com.pa\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/#primaryimage"},"image":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/#primaryimage"},"thumbnailUrl":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg","datePublished":"2026-10-06T12:35:51+00:00","dateModified":"2026-10-06T21:57:12+00:00","description":"Sanitiza\u00e7\u00e3o, WAF e ORM reduzem o risco de inje\u00e7\u00e3o de SQL, mas s\u00f3 a consulta parametrizada separa c\u00f3digo de dado. Veja exemplos e um checklist de code review.","breadcrumb":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/#primaryimage","url":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg","contentUrl":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/SQL-Injection-em-2026-por-que-prepared-statements-continuam-sendo-a-resposta.jpg","width":1280,"height":720,"caption":"Desenvolvedor digitando c\u00f3digo em um notebook, com um segundo monitor exibindo c\u00f3digo ao fundo, representando a revis\u00e3o de consultas ao banco de dados para prevenir inje\u00e7\u00e3o de SQL com prepared statements."},{"@type":"BreadcrumbList","@id":"https:\/\/www.flane.com.pa\/blog\/pt\/injecao-de-sql-prepared-statements\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.flane.com.pa\/blog\/es\/"},{"@type":"ListItem","position":2,"name":"SQL Injection em 2026: por que prepared statements continuam sendo a resposta"}]},{"@type":"WebSite","@id":"https:\/\/www.flane.com.pa\/blog\/#website","url":"https:\/\/www.flane.com.pa\/blog\/","name":"TechTalk powered by Fast Lane LATAM","description":"Sharing ideas and knowledge on IT training and certification","publisher":{"@id":"https:\/\/www.flane.com.pa\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.flane.com.pa\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/www.flane.com.pa\/blog\/#organization","name":"Fast Lane Brasil","url":"https:\/\/www.flane.com.pa\/blog\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.flane.com.pa\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2019\/10\/fast-lane-ng3.png","contentUrl":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2019\/10\/fast-lane-ng3.png","width":209,"height":31,"caption":"Fast Lane Brasil"},"image":{"@id":"https:\/\/www.flane.com.pa\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/FastLane.br","https:\/\/x.com\/FastLaneBr","https:\/\/www.instagram.com\/fastlane.br\/","https:\/\/www.linkedin.com\/company\/fastlanebr"]},{"@type":"Person","@id":"https:\/\/www.flane.com.pa\/blog\/#\/schema\/person\/137dd93330c10cbd683159ae4b4ff9c4","name":"Mayara Pimentel","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g","caption":"Mayara Pimentel"},"sameAs":["https:\/\/www.instagram.com\/mayara.piimentel\/","https:\/\/www.linkedin.com\/in\/mayara-pimentel\/"],"url":"https:\/\/www.flane.com.pa\/blog\/author\/mayarap\/"}]}},"_links":{"self":[{"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/posts\/12567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/comments?post=12567"}],"version-history":[{"count":4,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/posts\/12567\/revisions"}],"predecessor-version":[{"id":12578,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/posts\/12567\/revisions\/12578"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/media\/12573"}],"wp:attachment":[{"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/media?parent=12567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/categories?post=12567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/tags?post=12567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}