An administrator is reviewing logs and sees the following entry: Message: Access denied with code 403 (phase 2). Pattern match "\bunion\b.{1,100}?\bselect\b" at ARGS:$id. [data "union all select"]…

Session hijacking involves stealing or forging authentication session tokens, not crafting UNION SELECT SQL syntax against a query parameter.

Cross-site scripting injects client-side script payloads into web page output, whereas this log shows SQL keyword patterns targeting a backend database query.

The log pattern `\bunion\b.{1,100}?\bselect\b` and the matched data `union all select` are classic signatures of a SQL injection attack using a UNION-based technique to append a secondary SELECT query. The tags WASCTC/WASC-19 and OWASP_TOP_10/A1 explicitly categorize the event as SQL injection, and the ModSecurity WAF intercepted it at phase 2 before the query could reach the database.

Buffer overflow attacks target memory boundaries in application code, not SQL query parsers, and produce entirely different signatures than UNION SELECT strings.