SQL injection is best described as?

SQL injection is best described as?

• A. A code injection technique that might destroy your database, placing malicious code in SQL statements via user input
• B. A method to encrypt SQL queries
• C. A method for server login authentication
• D. A technique for database backup

Answer: (A)

SQL injection is a code injection vulnerability where attacker-supplied input is used to alter the structure of SQL queries. When an application builds SQL by directly inserting user input, an attacker can inject additional SQL syntax that changes the query’s meaning, potentially bypassing authentication, leaking data, or even executing destructive operations on the database. That’s why the description describing placing malicious code in SQL statements via user input best captures the issue. It isn’t about encrypting queries, authenticating users, or backing up data. Mitigation relies on parameterized queries or prepared statements, proper input validation, least-privilege database accounts, and careful error handling.

SQL injection is a code injection vulnerability where attacker-supplied input is used to alter the structure of SQL queries. When an application builds SQL by directly inserting user input, an attacker can inject additional SQL syntax that changes the query’s meaning, potentially bypassing authentication, leaking data, or even executing destructive operations on the database. That’s why the description describing placing malicious code in SQL statements via user input best captures the issue. It isn’t about encrypting queries, authenticating users, or backing up data. Mitigation relies on parameterized queries or prepared statements, proper input validation, least-privilege database accounts, and careful error handling.