Preventing SQL Injection Attacks

Vocabulary flashcards covering core concepts of SQL, SQL injection categories, and injection prevention techniques.

Structured Query Language (SQL)

A programming language used to create, interact with, and request information from a database.

SQL injection

A type of attack that executes unexpected queries on a database to modify, delete, or steal information, or to gain unauthorized access to web applications.

Database

An organized collection of information or data in one place, typically organized in tables when using SQL.

SQL query

A request for data from a database, commonly used for retrieving, inserting, updating, or deleting information in tables.

Input fields

Application or website features that accept text input—such as login forms, search bars, or comment submission boxes—where queries are usually initiated.

In-band SQL injection

A classic and common type of SQL injection that uses the same communication channel to launch the attack and gather the results.

Out-of-band SQL injection

A category of SQL injection that uses a different communication channel to launch the attack and gather the results, bypassing security controls on the website's server.

Inferential SQL injection

A category of SQL injection that occurs when an attacker cannot directly see the results of their attack and instead interprets the results by analyzing the behavior of the system.

Escaping user inputs

A key practice for preventing SQL injection attacks by stopping someone from inserting any code that a program is not expecting.

Prepared statements

A coding technique that executes SQL statements before passing them on to a database.

Input sanitization

Programming that removes user input which could be interpreted as code.

Input validation

Programming that ensures user input meets a system's expectations.