In short
A Structured Query Language (SQL) injection attack enters database commands into an input field, such as a login form, that an application passes to its database without proper checking, letting the attacker read, change or delete data.
Key takeaways
- Parameterized queries, which keep data separate from commands, are the main defense.
- Input validation and least-privilege database accounts limit the damage.
- Web application firewalls can block common attack patterns.
Where it's tested
ISC: Information Security Fundamentals — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
To send a confidential message that only the intended recipient can read, which key should the sender use to encrypt it?