alleryStart learning →SQL INJECTION (SQLi) is a vulnerability where an attacker
Aguesses the database password
Binserts malicious SQL via user input
Cphysically steals the database server
DDDoSes the database
Answer & Solution
Correct answer: B. inserts malicious SQL via user input
1. SQL INJECTION: when application code builds SQL by string-concatenating user input.
2. Example: `SELECT * FROM users WHERE name = '` + userInput + `'`. If userInput = `' OR '1'='1`, the query becomes `... WHERE name = '' OR '1'='1'` — returns all rows.
3. PRIMARY MITIGATION: PARAMETERISED QUERIES (prepared statements). User input is passed as a separate parameter, never inlined into SQL string.
4. Secondary mitigations: input validation, least-privilege DB user, web application firewall (WAF).
5. Falls under A03: Injection in OWASP Top 10 2021.
_Source: OWASP Top 10 2021 — A03: Injection._
Keep practising Web Security — OWASP
Browse all Web Security — OWASP questions for BCA Cyber Security, or explore more Cybersecurity topics.
Related questions
Tap what belongs to the named riskWhat does HTTPS provide over plain HTTP?Which OWASP category covers using libraries with KNOWN CVEs?An IDOR (Insecure Direct Object Reference) attack happens whenCROSS-SITE REQUEST FORGERY (CSRF) is best mitigated byWhich mitigation is the SINGLE most effective defense against SQL Injection?What does the SECURITY MISCONFIGURATION category (A05 in 2021) typically include?The OWASP 2021 category A04 'INSECURE DESIGN' is a NEW category that addresses