This deep dive covers Deep Dive: SQL Injection Explained within Technical Attacks for GCSE Computer Science. Revise Technical Attacks in 3.6 Fundamentals of Cyber Security for GCSE Computer Science with 18 exam-style questions and 16 flashcards. This is a high-frequency topic, so it is worth revising until the explanation feels precise and repeatable. It is section 4 of 9 in this topic. Use this deep dive to connect the idea to the wider topic before moving on to questions and flashcards.
Deep Dive: SQL Injection Explained
SQL injection exploits poorly coded websites that don't validate user input. Here's a step-by-step example:
Normal login process:
- User enters username:
alice - Website creates SQL query:
SELECT * FROM users WHERE username='alice' - Database checks if 'alice' exists and returns the user record
SQL injection attack:
- Attacker enters username:
' OR '1'='1 - Website creates SQL query:
SELECT * FROM users WHERE username='' OR '1'='1' - Since
'1'='1'is ALWAYS true, this returns ALL users - bypassing authentication! - Attacker gains unauthorized access without knowing any passwords
Prevention methods:
- Input validation: Check that inputs match expected format (e.g., usernames contain only letters/numbers)
- Input sanitization: Remove or escape special characters like quotes
- Parameterised queries: Separate SQL code from user data so injected code isn't executed
- Prepared statements: Pre-compile SQL queries so user input can't alter query structure
Practice questions for Technical Attacks
Which of the following best describes a brute force attack?
Explain what a DDoS attack is and how it affects a network.