ITPEC FE Morning April 2022 Question 36

Data the web application does not expose is retrieved or modified — injected SQL runs in the database with the application's privileges, beyond what its screens allow.

In SQL injection the attacker types SQL fragments into a form field or URL parameter. If the application builds its query by joining that input into the SQL text without escaping or placeholders, the database executes the attacker's SQL. Entering ' OR '1'='1 into a login field makes the WHERE condition always true, and an appended UNION SELECT can read other tables. The direct damage is to the stored data: records the application never shows, such as other users' details or passwords, are read, altered or deleted.

Answer (b)

Why not others:

• •(a) — modifying packets in transit is a man-in-the-middle attack on the communication path, not on the application's queries.
• •(c) — capturing every keystroke is the work of a keylogger on the user's device.
• •(d) — capturing and altering IP headers is sniffing and spoofing at the network layer.

Key rule: SQL injection attacks the database through unchecked input, and its defence is to pass input only through placeholders (prepared statements), never by building SQL text from it.

Security · AI-written, may contain errors