2.4 - SQL Injection

Question 1

Code injection

Answer 1

• Code injection
  – Adding your own information into a data stream
• Enabled because of bad programming
  – The application should properly handle input
  and output
• So many different data types
  – HTML, SQL, XML, LDAP, etc.

Question 2

SQL injection

Answer 2

• SQL - Structured Query Language
  – The most common relational database management
  system language
• SQL Injection
  – Modify SQL requests (Your application shouldn’t allow this)
• If you can manipulate the database,
  then you control the application
  – A significant vulnerability