What is SQL Injection?

What is SQL Injection?

• A. A method of encrypting data in transit.
• B. A technique for loading SQL libraries at runtime.
• C. The unauthorized insertion of SQL code into a data form to steal or harm data.
• D. A feature that prevents multiple users from modifying data concurrently.

Answer: (C)

SQL injection is a vulnerability where an attacker can input SQL statements into an application's data fields, and those statements get executed by the database. This happens when user-supplied data is inserted into SQL queries without proper sanitization or parameterization, allowing the attacker to change the query’s meaning. Because the input becomes part of the SQL command, an attacker can bypass authentication, read or modify data, or even run administrative operations on the database. That’s why the description focusing on unauthorized insertion of SQL code into a data form to steal or harm data is the correct choice. To defend against it, use prepared statements with parameter binding, avoid building SQL by concatenating strings, validate and sanitize inputs, apply least-privilege database accounts, and consider proper use of stored procedures and input validation. The other options describe unrelated concepts like encrypting data in transit, loading libraries at runtime, or concurrency control, which do not describe SQL injection.

SQL injection is a vulnerability where an attacker can input SQL statements into an application's data fields, and those statements get executed by the database. This happens when user-supplied data is inserted into SQL queries without proper sanitization or parameterization, allowing the attacker to change the query’s meaning.

Because the input becomes part of the SQL command, an attacker can bypass authentication, read or modify data, or even run administrative operations on the database. That’s why the description focusing on unauthorized insertion of SQL code into a data form to steal or harm data is the correct choice.

To defend against it, use prepared statements with parameter binding, avoid building SQL by concatenating strings, validate and sanitize inputs, apply least-privilege database accounts, and consider proper use of stored procedures and input validation. The other options describe unrelated concepts like encrypting data in transit, loading libraries at runtime, or concurrency control, which do not describe SQL injection.