SQL Injection in Power Apps - With Amichai Shulman, Co-Founder & CTO
Citizen developers trust Power Automate and Microsoft Forms to run “internal” processes, but a single form field can open a direct path from the internet into your core databases. In this demo, we show how a simple customer complaint form in the Power Platform turns into an SQL injection attack that exposes user records and salary data, and how a small change to the flow blocks the attack completely.
If you lead AppSec or own Microsoft Power Platform security, this is a real look at how no-code business apps create an external attack surface that sits far outside classic SDLC controls. You will see how citizen development, shadow IT and low-code no-code security gaps connect external attackers to critical enterprise data, and what a practical fix looks like in a live Power Automate flow.
We also touch on broader no code application security and low code application security problems in business platforms, and why they are now a serious part of shadow IT security risks. Topics include low code no code security on Microsoft Power Platform, SQL injection in Power Automate, safe database access with parameterized queries, and how AppSec teams can fold citizen developer governance into their existing low code security automation practices without slowing the business.
🔍 Key takeaways:
✅ How a “simple” customer complaint form evolves into an SQL injection path into your database
✅ What attacker input looks like in the username field and how it returns a list of users and salaries
✅ Why pasting raw user input into SQL queries inside Power Automate creates a direct data exposure
✅ How to fix the flow with parameterized queries in Power Automate so user input cannot change your SQL logic
✅ Why Microsoft Forms, emails, social media, ERP tickets and other external inputs all expand the same attack surface
✅ What this means for low code / no code security, shadow IT in cyber security, and AppSec ownership for citizen developers
✅ How Nokod Security helps AppSec teams get visibility into no-coder apps and move from blind spots to fast wins across Power Platform and other business app platforms
🌐 Learn more about Nokod Security
Website: https://nokodsecurity.com
LinkedIn: / nokodsecurity
📌 Stay engaged:
👍 LIKE this video if you want more real attack demos in low-code and no-code environments
💬 COMMENT: How are you handling Microsoft Power Platform security and SQL injection risk from citizen developers today?
📢 SUBSCRIBE to stay updated on no-coders security, Power Platform security, Copilot data protection and shadow IT security risks in business apps
Request a live demo of our Power Platform security solution and see your own no-coder “jungle” mapped from visibility to remediation.