SQL injection exploits poorly coded websites that don't validate user input. Here's a step-by-step example:
Normal login process:
- User enters username:
alice - Website creates SQL query:
SELECT * FROM users WHERE username='alice' - Database checks if 'alice' exists and returns the user record
SQL injection attack:
- Attacker enters username:
' OR '1'='1 - Website creates SQL query:
SELECT * FROM users WHERE username='' OR '1'='1' - Since
'1'='1'is ALWAYS true, this returns ALL users - bypassing authentication! - Attacker gains unauthorized access without knowing any passwords
Prevention methods:
- Input validation: Check that inputs match expected format (e.g., usernames contain only letters/numbers)
- Input sanitization: Remove or escape special characters like quotes
- Parameterised queries: Separate SQL code from user data so injected code isn't executed
- Prepared statements: Pre-compile SQL queries so user input can't alter query structure
This deep dive covers Deep Dive: SQL Injection Explained within Technical Attacks for GCSE Computer Science. Revise Technical Attacks in 3.6 Fundamentals of Cyber Security for GCSE Computer Science with 18 exam-style questions and 16 flashcards. This is a high-frequency topic, so it is worth revising until the explanation feels precise and repeatable. It is section 4 of 9 in this topic. Use this deep dive to connect the idea to the wider topic before moving on to questions and flashcards.
Practice questions for Technical Attacks
Which of the following best describes a brute force attack?
Explain what a DDoS attack is and how it affects a network.