Which attack involves injecting a database query via user-supplied input to a server?

Which attack involves injecting a database query via user-supplied input to a server?

• A. Clickjacking
• B. Cross-site scripting
• C. SQL injection
• D. Buffer overflow

Answer: (C)

This question tests understanding of how user input can influence a database query on the server. SQL injection occurs when an application builds a SQL query by concatenating or interpolating user-supplied data without proper safeguards. An attacker can insert SQL syntax as part of their input, changing the intended query logic. For example, a login check might assemble a query like SELECT * FROM users WHERE username = 'user' AND password = 'pass'. If the input is crafted as ' OR '1'='1, the query becomes logically true for all rows, potentially bypassing authentication and exposing data. The standard defense is to use parameterized queries (prepared statements) so user input is treated as data, not executable SQL; also validate input, apply least-privilege database accounts, and consider stored procedures with parameters. Other listed attacks target different layers: clickjacking tricks users into clicking hidden UI elements; cross-site scripting injects script into web pages executed in a victim's browser; buffer overflow exploits memory management by overflowing buffers. All of these are not about altering server-side queries via user input.

This question tests understanding of how user input can influence a database query on the server. SQL injection occurs when an application builds a SQL query by concatenating or interpolating user-supplied data without proper safeguards. An attacker can insert SQL syntax as part of their input, changing the intended query logic. For example, a login check might assemble a query like SELECT * FROM users WHERE username = 'user' AND password = 'pass'. If the input is crafted as ' OR '1'='1, the query becomes logically true for all rows, potentially bypassing authentication and exposing data. The standard defense is to use parameterized queries (prepared statements) so user input is treated as data, not executable SQL; also validate input, apply least-privilege database accounts, and consider stored procedures with parameters. Other listed attacks target different layers: clickjacking tricks users into clicking hidden UI elements; cross-site scripting injects script into web pages executed in a victim's browser; buffer overflow exploits memory management by overflowing buffers. All of these are not about altering server-side queries via user input.