Database Fundamentals

Chapter 1

Database Fundamentals

Course: Comptia Datasys Ds0 001
Subject: Comptia Datasys Plus Ds0 001
Chapter: Data And Database Security

1. SQL Injection (SQLi)

Definition SQL Injection is a web security vulnerability where an attacker manipulates SQL queries by injecting malicious input into application fields, such as forms or URL parameters. It exploits improper handling of user input in backend SQL statements.

How it works When user input is directly included in SQL queries without sanitization or parameterization, attackers can modify the intended SQL logic. For example, a login form that builds a query like:

sql

SELECT * FROM users WHERE username = '$user' AND password = '$pass';

can be exploited if a user inputs admin' OR '1'='1 in the username field, resulting in:

sql

SELECT * FROM users WHERE username = 'admin' OR '1'='1' AND password = '';

This always evaluates as true, potentially allowing access without credentials.