Dev MaxxingAdvancedApplication Security90 sec

Injection attack

An injection attack occurs when untrusted user input is inserted directly into a command or query, letting an attacker change its meaning to do something unintended.

Mark as completed

Prerequisite: SQL query

What matters

Because it exploits code that trusts input too much, an injection attack can let an attacker read, modify, or delete data far beyond what the application intended to expose.

Example

If user input is inserted directly into a SQL query without proper handling, an attacker could craft input that alters the query to return every user's data, not just their own.

Common misconception

An injection attack is not prevented by simply checking input length or basic formatting; it requires properly separating user input from the command or query structure itself.

Recall question

Why does trusting user input directly inside a query create an injection risk?

Keywords and related concepts