TOPIC SECURITY
Injection Attacks when input becomes code
IN 10 SECONDS
An attack where malicious input strings are interpreted as system commands (SQL, Shell, HTML). Input sanitization and parameterized queries keep input separated from executable commands.
GOTCHA Concatenating user inputs directly in strings to build CLI commands, SQL queries, or HTML pages leaves you open to script injections.
HOW INJECTION EXECUTIONS OCCUR
01 User Input attacker types: 1' OR '1'='1 into a search bar.
02 App query application concatenates strings to run sql database commands.
03 Execution database engine interprets input OR '1'='1 as instructions, returning all tables.
POKE IT YOURSELF
sqlmap -u \"https://example.com/item?id=1\" — test endpoints for SQL injection vulnerabilities
Drill this topic →
~65 sec read