I have a 3rd party API that I need to connect to and they allow queries that can be formed by changing url parameters.
E.g. /data?startDate=2019-01-01
or /data?name='John Doe'
It is easy to form these queries by concatenating strings, but input cannot be trusted (our API is exposed to end users and accept parameters that have to be sent to the 3rd party API). That means that anyone can try to inject something in our URL and then it will be sent to the 3rd party.
If our API was talking to an SQL server, we could have used prepared queries to prevent injection, but how to do that with a URL?
It's possible to check that e.g. date is just date, but what if a custom string like name is allowed?
Example:
A query to a 3d party API: /data?$filter=(userId eq 1) and (startswith(someField, {userInput})) eq true
User input to my API: userInput="someText) or (userId eq 2"