SQL injection in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is SQL injection?

SQL injection is a security vulnerability where an attacker inserts malicious SQL code into a query, allowing unauthorized access or manipulation of a database.

beginner

How does SQL injection typically happen?

It happens when user input is directly included in SQL queries without proper checks or cleaning, letting attackers add harmful commands.

beginner

Name one common way to prevent SQL injection.

Using prepared statements or parameterized queries, which separate code from data, preventing attackers from changing the query structure.

intermediate

What could be a real-life impact of a successful SQL injection attack?

Attackers might steal sensitive data like passwords, delete important information, or take control of the entire database.

intermediate

Why is input validation alone not enough to stop SQL injection?

Because attackers can find ways to bypass simple checks; combining input validation with prepared statements is safer.

What does SQL injection allow an attacker to do?

A Encrypt user passwords

B Improve website speed

C Backup the database automatically

D Run unauthorized database commands

SQL injection lets attackers run harmful commands on the database without permission.

Which practice helps prevent SQL injection?

A Storing passwords in plain text

B Ignoring user input

C Using prepared statements

D Allowing all input without checks

Prepared statements keep code and data separate, stopping attackers from injecting harmful SQL.

SQL injection attacks usually target which part of an application?

A User interface design

B Database queries

C Network cables

D Operating system files

SQL injection targets the database queries that use user input.

What is a sign that a website might be vulnerable to SQL injection?

A Error messages showing database details

B Fast page loading

C Colorful website design

D Strong password requirements

Detailed error messages can reveal database info that attackers use to exploit SQL injection.

Which of these is NOT a good defense against SQL injection?

A Disabling firewalls

B Escaping user input properly

C Using parameterized queries

D Limiting database user permissions

Disabling firewalls weakens security and does not help prevent SQL injection.

Explain what SQL injection is and why it is dangerous.

Think about how attackers use input fields to run harmful database commands.

Describe at least two methods to prevent SQL injection attacks.

Consider how separating code from data and checking inputs helps.