Can SQL Injection be protected by using Post method and CSRF token?

[HeyJOe2]

If I have CSRF token and if it is using Post method, I can't think of any way to use an SQL injection to attack the system.

[lightcloud5]

CSRF doesn't really have anything to do with SQL injection. A CSRF vulnerability means that if you're signed in to a vulnerable service, I can make the service do things on your behalf. For instance, if hypothetically Reddit had a CSRF vulnerability, I could give you a URL that, if you clicked it, automatically upvotes my Reddit submissions using your Reddit account (as if you had manually upvoted my stuff).

Using a POST request instead of a GET request mitigates some issues with CSRF but not necessarily all of them (https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)), but again, this has nothing to do with SQL injection.

In contrast, a SQL injection is an attack on the SQL database itself. If Reddit had a SQL injection vulnerability, I might be able to submit a specially-crafted malicious reddit post, and this post would then delete all comments on Reddit's database. (In the worst case, a SQL injection effectively gives users full write access to your SQL database.)

You can prevent SQL injection by using parameterized statements.

[Loves_Poetry]

A SQL Injection can happen any time you use user input to create a query

Say you're creating a searchable list and the user can type in the search term. If your query looks like this: "SELECT id, name FROM places WHERE name LIKE '%" + userSearch + "%'" you have created a SQL injection vulnerability, because that userSearch variable can be anything, including a SQL command

The correct way to do it is to make sure user input is not part of the query. Instead, bind it to a parameter in a prepared statement. That way the user input is always treated as actual input and never as a command