What attack is commonly used to gain unauthorized access to a database?

What attack is commonly used to gain unauthorized access to a database?

• A. SQL Injection
• B. Cross-Site Scripting
• C. Buffer Overflow
• D. Phishing

Answer: (A)

SQL injection attacks exploit insecure input handling to alter the database query that a web application builds from user input, allowing unauthorized access or data extraction. When an application constructs SQL statements by directly concatenating user input without proper validation or parameterization, an attacker can inject SQL fragments that change the query’s logic, such as bypassing authentication or pulling data from tables. For example, supplying crafted input in a login form can convert a normal query into one that always evaluates to true, granting access. Preventing this relies on parameterized queries or prepared statements, strict input validation, and least-privilege database accounts. Cross-Site Scripting focuses on injecting scripts into webpages to run in other users’ browsers, not on directly accessing the database. A buffer overflow aims at memory corruption to execute arbitrary code on a system, which is a broader attack vector but not specifically a database-access technique. Phishing targets people to steal credentials through deception, not by manipulating database queries.

SQL injection attacks exploit insecure input handling to alter the database query that a web application builds from user input, allowing unauthorized access or data extraction. When an application constructs SQL statements by directly concatenating user input without proper validation or parameterization, an attacker can inject SQL fragments that change the query’s logic, such as bypassing authentication or pulling data from tables. For example, supplying crafted input in a login form can convert a normal query into one that always evaluates to true, granting access. Preventing this relies on parameterized queries or prepared statements, strict input validation, and least-privilege database accounts.

Cross-Site Scripting focuses on injecting scripts into webpages to run in other users’ browsers, not on directly accessing the database. A buffer overflow aims at memory corruption to execute arbitrary code on a system, which is a broader attack vector but not specifically a database-access technique. Phishing targets people to steal credentials through deception, not by manipulating database queries.