The concept of SQL injection

Forms of attack: The concept of SQL injection

1.4.1 Threats to computer systems and networks

Threats to computer systems and networks — Note 7 of 7

What you need to know

SQL injection is an attack where malicious SQL code is entered into a website's input fields (like login boxes or search forms). If the website does not properly validate input, the code can be executed by the database.

What to know

Can allow attackers to: view private data, modify or delete records, bypass authentication, or take control of the database.
Exploits websites that do NOT properly check/validate/sanitise user input.

Key terms

Exam tipCommon mistake

SQL Injection: An attack where specially crafted SQL code is entered into a website's input fields. If input is not validated, the malicious code runs on the database.
Exam tip: SQL injection targets the DATABASE through INPUT FIELDS. The defence is INPUT VALIDATION/SANITISATION — checking that input does not contain SQL commands.
Common mistake: Saying SQL injection 'hacks the server'. It specifically targets the DATABASE by injecting code through input fields.

Ready to test yourself?

Practise 1.4.1 questions

← Previous noteData interception and theft1.4.1 Threats to computer systems and networks Next topic →Common prevention methods1.4.2 Identifying and preventing vulnerabilities

Back to Threats to computer systems and networks

Revise another OCR GCSE topic: Identifying and preventing vulnerabilities