Two channels that must never be one
A search endpoint builds its query by joining strings:
SELECT * FROM users WHERE name = '" + input + "'
The query text and the user's data travel to the database as one string. By the time the parser sees it, there is no way to tell which characters were the developer's instructions and which came from the request — so input like ' OR 1=1 -- stops being data and becomes SQL.
Boundaries, outermost first: API service: an empty slot for the the control channel, an empty slot for the the data channel Outside every boundary: Client (untrusted input), Database (least privilege; FAILED: dumped) Connections: Client calls the data channel — user input (step 1) the control channel calls Database — WHERE name = ? (step 2) the data channel calls Database — bound value (step 3)