A security administrator notices that the log file of the company's webserver contains suspicious entries: Based on source code analysis, the analyst concludes that the login.php script is…

Command injection requires the application to pass user input to an operating system shell function, which is unrelated to database authentication logic in login.php.

SQL injection exploits the failure to sanitize user-supplied input before embedding it in SQL queries, allowing an attacker to manipulate query logic. Login scripts like login.php are a primary target because they typically query a database to validate credentials. Malicious input such as ' OR '1'='1 can bypass authentication or expose data from the MSSQL backend.

Directory traversal exploits insufficient path validation to access files outside the web root using sequences like '../', not login form parameters.

LDAP injection manipulates LDAP queries and would require the application to use an LDAP directory for authentication rather than a SQL database.