SQL Injection
Computer Science: OCR GCSE, topic 1.4.11
Structured Query Language (SQL) Injection
Almost all websites today are powered by databases on the server. Structured Query Language (SQL) injection is an attack which exploits these databases.
The attack
- Structured Query Language (SQL) is a language used to access databases.
- SQL injection is a form of active attack that exploits SQL execution on web servers.
- Attackers 'inject' specially formatted code into fields in the website, which when run on the server allow them to bypass login screens or damage the data kept on the server.
Protection against SQL injection
- Input validation sets username and password rules that don't permit the character needed to write SQL code.
- Input sanitation inspects the user's input and removes SQL command words from the input before it is processed.
- User access levels can be set up to prevent the web server from altering the contents of the database.
Test yourself on SQL Injection
What type of cyberattack is Structured Query Language (SQL) injection?
A Structured Query Language (SQL) Injection Attack
How does input validation protect against Structured Query Language (SQL) injection?