SQL injection is a type of cyber attack that targets databases through web applications. (a) Describe how an SQL injection attack works. [3] (b) State two t...

(a) How an SQL injection attack works [3]

The attacker enters malicious SQL code into an input field on a web form, such as a login box, search bar, or registration form. [1]

If the web application does not properly validate or sanitise the user input, the SQL code is passed directly to the database server as part of the query, rather than being treated as plain text data. [1]

The malicious SQL code is then executed by the database, potentially allowing the attacker to view confidential data, modify or delete records, or bypass authentication checks entirely. [1]

(b) Two types of damage from a successful SQL injection [2]

1. The attacker could access and steal sensitive data such as customer names, email addresses, passwords, and payment card details from the database. [1]
2. The attacker could delete or corrupt data in the database, causing the application to malfunction and potentially losing important business records permanently. [1]

(c) Three methods to prevent SQL injection attacks [3]

1. Parameterised queries (prepared statements): These separate the SQL code structure from the user-supplied data, ensuring that user input is always treated as data values and never as executable SQL commands. [1]
2. Input validation and sanitisation: Check all user input to ensure it matches expected formats (e.g. an email field should contain an @ symbol) and reject any input containing SQL keywords or special characters such as single quotes or semicolons. [1]
3. Restrict database permissions: Limit the database privileges of the web application's account to only what is strictly necessary (e.g. SELECT only, not DROP or DELETE), so that even if an injection succeeds, the potential damage is minimised. [1]

(d) How an attacker could exploit the given login query [2]

The attacker could enter a value such as ' OR '1'='1 as the username. [1]

This modifies the SQL query so that the WHERE condition always evaluates to TRUE (since '1'='1' is always true), causing the database to return all user records and allowing the attacker to log in without knowing a valid password. [1]

(e) Cross-site scripting and differences from SQL injection [4]

Cross-site scripting (XSS) is an attack where malicious scripts (typically JavaScript) are injected into a trusted website. When other users visit the page, the malicious script executes in their browsers, potentially stealing session cookies, redirecting users to fake sites, or capturing keystrokes. [1]

Difference 1: SQL injection targets the server-side database by manipulating SQL queries, while XSS targets client-side users by injecting scripts into web pages that execute in their browsers. [1]

Difference 2: SQL injection can result in direct data theft or modification from the database, while XSS typically steals session cookies, captures user input, or redirects users to fraudulent sites. [1]