SQL Injection

Question 1

What is the SQL acronym short for?

Answer 1

Structured Query Language

Also known as See-qwel

Question 2

What is SQL used for?

Answer 2

It’s the way that a web application communicates to a database server to ask for information.

Note: This makes it a popular target for an attack.

Question 3

What is an SQL Injection?

Answer 3

An attack consisting of insertion or injection of an SQL query into a data input field from the client to the web app.

Question 4

What is an Injection attack and what are the 4 different code injection vectors?

Which is the most common?

Answer 4

The attacker inserts additional information or code, through the data input field in a web application.

This can occur in SQL, HTML, XML, and LDAP

Note: SQL is by far the most common.

Question 5

How is an SQL injection prevented?

Answer 5

Through proper input validation and using least privilege.

Note: If an exam question has anything referring to a:

` OR 1=1, ` OR 100=100 etc..

this is an SQL injection.