Which attack involves injecting a database query into input data directed at a server, allowing unintended access or manipulation of data?

Which attack involves injecting a database query into input data directed at a server, allowing unintended access or manipulation of data?

• A. Command injection
• B. SQL injection
• C. Path traversal
• D. Buffer overflow

Answer: (B)

Injecting a database query into input data directed at a server exploits how a server builds SQL statements from user input. When input is incorporated directly into an SQL command without proper separation, the attacker can alter the query’s logic, enabling unauthorized data access, modification, or even bypassing authentication. This is the essence of SQL injection: user-supplied input becomes part of the SQL sent to the database. This differs from other attacks in the options: command injection targets executing operating system commands on the server; path traversal aims to reach files outside the intended directory by manipulating file paths; and a buffer overflow abuses memory boundaries to crash or take control of the program. To defend, use parameterized queries or prepared statements, validate and sanitize inputs, implement least-privilege database accounts, and handle errors securely.

Injecting a database query into input data directed at a server exploits how a server builds SQL statements from user input. When input is incorporated directly into an SQL command without proper separation, the attacker can alter the query’s logic, enabling unauthorized data access, modification, or even bypassing authentication. This is the essence of SQL injection: user-supplied input becomes part of the SQL sent to the database.

This differs from other attacks in the options: command injection targets executing operating system commands on the server; path traversal aims to reach files outside the intended directory by manipulating file paths; and a buffer overflow abuses memory boundaries to crash or take control of the program. To defend, use parameterized queries or prepared statements, validate and sanitize inputs, implement least-privilege database accounts, and handle errors securely.