SQL injection
Also called: SQL-injection attack, SQLi
Course: AP® Cybersecurity Shows up in: Unit 5: Securing Applications and Data
An attack that places structured query language (SQL) commands and control characters into an input field, so the application returns too much data or changes and deletes data.
Appears in the course and exam description (CED): 5.1.B.35.1.B.45.6.E.1
Why it matters in Unit 5
Breaches confidentiality or integrity of a database. In logs: quotes, OR 1=1, -- and SQL words.
Example
Entering x' OR 1=1 -- in a login field.