Which attack involves inserting malicious SQL statements into a web application's input fields?

Question

Options

• ACross-Site Scripting (XSS)
• BSQL Injection
• CPhishing
• DBuffer Overflow

• A
  3% (1)
• B
  94% (34)
• D
  3% (1)

Explanation

SQL Injection (B) is correct because it specifically describes the technique of inserting (injecting) malicious SQL code into input fields - such as login forms or search boxes - to manipulate the backend database, potentially exposing or deleting data.

Why the distractors are wrong:

• A (XSS) injects malicious JavaScript into web pages to attack other users' browsers, not the database.
• C (Phishing) uses deceptive emails or fake websites to trick users into revealing credentials - no code injection involved.
• D (Buffer Overflow) overwrites adjacent memory by sending more data than a buffer can hold, targeting memory/application logic, not database queries.

Memory tip: Think of the word "injection" literally - SQL Injection injects SQL into a query. The attack lives in the database layer, so whenever you see "SQL statements" + "input fields," the answer is SQL Injection.

No community discussion yet for this question.