SQL Injection Flashcards

A code injection attack that inserts malicious SQL commands into input fields an application passes to a database. If the application doesn't validate the input, the database executes the attacker's SQL as part of the intended query — allowing data theft, modification, deletion, or authentication bypass.

Bad programming — specifically failing to validate, sanitize, or escape user input before incorporating it into a SQL query. When an application builds queries by concatenating user input into a SQL string, the user can type SQL syntax that the database executes as commands rather than data.

The classic SQL injection payload. Appending OR '1'='1' to a WHERE clause makes the condition always true, returning every row in the table. Because 1 always equals 1, this tautology bypasses intended filters. Seeing OR 1=1 in web logs is a strong indicator of a SQL injection attempt.

The primary defense against SQL injection. The developer defines the SQL structure with placeholders first (SELECT * FROM users WHERE name = ?), then binds user input as a separate data value. The database engine treats bound values as literal data — never as SQL code. Even SQL syntax typed by the user cannot become executable commands.

Injecting SQL into a login form to gain access without valid credentials. By entering ' OR '1'='1'-- as the username, the attacker makes the authentication query always return true and comments out the password check. The database returns the first user — often an administrator — granting access with no password required.

An advanced technique appending a UNION SELECT statement to extract data from tables the original query never targeted. For example: ' UNION SELECT username, password FROM admin_users-- combines the original results with admin credential data. Allows attackers to pivot through the entire database schema from a single injection point.

(1) View — read any data in the database; (2) Modify — change records, prices, or access levels; (3) Delete — destroy tables or entire databases (DROP TABLE); (4) Deny — crash the database or make it unavailable. The actual reach depends on the permissions of the database account the application uses.

Granting the database account the application uses only the permissions it actually needs. A read-only application should use a SELECT-only account. If SQL injection succeeds, the attacker is limited to what the compromised account can do — a SELECT-only account cannot run DROP TABLE even if injected. Least privilege limits impact without preventing the injection itself.

A network-layer defense that detects and blocks known SQL injection patterns — OR 1=1, UNION SELECT, DROP TABLE, comment sequences. Valuable as a supplementary layer but not a substitute for parameterized queries. An attacker can use encoding or obfuscation to evade WAF signatures that would not fool a properly parameterized database.

Code injection is the broad category — inserting executable code into a data stream processed by an application. SQL injection is the specific type targeting relational databases. Other code injection types include HTML injection, XML injection, and LDAP injection. On the exam: if the scenario involves a database and SQL being executed from user input, the answer is SQL injection (a type of code injection).