ITPEC FE Morning April 2018 Question 39

SQL Injection — Identifying the correct definition of an SQL injection attack

SQL injection exploits flaws in how a web application constructs database queries. An attacker enters a malicious string (e.g., ' OR 1=1 --) into an input field, and if the application concatenates it directly into an SQL statement, the attacker can retrieve, modify, or delete data without authorization.

Correct answer: c) — describes exploiting a defect in how the database is called from a web app by injecting a malicious character string in the data manipulation language. This matches SQL injection exactly.

Why not the others:
- a) Describes a DDoS attack — flooding a website with traffic to deny service
- b) Describes a buffer overflow attack — writing data beyond memory boundaries to execute injected code
- d) Describes Cross-Site Scripting (XSS) — injecting a malicious script that executes in the victim's browser via a vulnerable website

Key rule: SQL injection targets the database layer through malicious query manipulation; XSS targets the browser through malicious script execution.

AI-generated — may contain errors