Which of the following statements about SQL injection attacks is true?

Question

Options

• AThey can only be executed via GET requests.
• BThey are only successful on outdated database systems.
• CThey can reveal sensitive data from the database.
• DThey require the attacker to have direct access to the database server.

• A
  2% (1)
• B
  7% (3)
• C
  86% (38)
• D
  5% (2)

Explanation

SQL injection attacks work by inserting malicious SQL code into input fields, tricking the database into executing unintended queries - this makes C correct, as attackers can extract passwords, personal data, financial records, or any other stored information without authorization.

Why the distractors are wrong:

• A is false because SQL injection can be delivered through any HTTP method (POST, PUT, headers, cookies) - not just GET parameters.
• B is false because SQL injection is a logic flaw in how queries are constructed, not a software version vulnerability; even modern, fully patched databases are susceptible if input isn't properly sanitized.
• D is false because the entire danger of SQL injection is that the attacker exploits the application layer to reach the database indirectly - no direct database access is needed at all.

Memory tip: Think of SQL injection as "speaking the database's language through the front door" - the attacker never touches the server physically but uses the app as a translator to steal data.

No community discussion yet for this question.