Which method is used for a SQL injection attack?

Which method is used for a SQL injection attack?

• A. Exploiting query parameters
• B. Brute-forcing passwords
• C. Encrypting data before sending to server
• D. Exploiting file upload vulnerabilities

Answer: (A)

SQL injection happens when user-supplied input is fed into a SQL statement without proper handling, allowing the attacker to alter the query’s logic. A common route is through query parameters in a URL or form field, where the application directly inserts that input into the SQL string. If the input contains crafted characters, it can terminate the string context and append additional SQL, for example turning a login check into a condition that always evaluates to true. This is why relying on dynamic string construction with user input is dangerous; the database ends up executing code you didn’t intend. Other options describe different security issues. Brute-forcing passwords targets credentials rather than manipulating SQL queries. Encrypting data before sending to the server protects data in transit but doesn’t fix unsafe query construction. Exploiting file upload vulnerabilities involves different attack vectors, such as uploading malicious scripts rather than altering SQL logic. Preventing SQL injection is best achieved by using parameterized queries or prepared statements, binding user input as parameters rather than concatenating it into the SQL string, along with input validation, proper error handling, and least-privilege database accounts.

SQL injection happens when user-supplied input is fed into a SQL statement without proper handling, allowing the attacker to alter the query’s logic. A common route is through query parameters in a URL or form field, where the application directly inserts that input into the SQL string. If the input contains crafted characters, it can terminate the string context and append additional SQL, for example turning a login check into a condition that always evaluates to true. This is why relying on dynamic string construction with user input is dangerous; the database ends up executing code you didn’t intend.

Other options describe different security issues. Brute-forcing passwords targets credentials rather than manipulating SQL queries. Encrypting data before sending to the server protects data in transit but doesn’t fix unsafe query construction. Exploiting file upload vulnerabilities involves different attack vectors, such as uploading malicious scripts rather than altering SQL logic.

Preventing SQL injection is best achieved by using parameterized queries or prepared statements, binding user input as parameters rather than concatenating it into the SQL string, along with input validation, proper error handling, and least-privilege database accounts.