What is SQL injection?

Instruction: Define SQL injection and its impact on database security.

Context: This question gauges the candidate's awareness of common security vulnerabilities in SQL databases and their implications.

Updated

Example Answer

SQL injection happens when untrusted input becomes SQL syntax instead of a value. For a customer lookup, I would bind the customer ID through the database driver's parameter API rather than concatenate it into the query. A stored procedure can still be vulnerable if it builds unsafe dynamic SQL. I would also restrict the database account's permissions and test hostile input as data, including quotes and comment characters.

Why this works

The key distinction is code versus data. Validation can enforce business rules, but escaping or removing suspicious characters is a fragile primary defense. Placeholders bind values; they usually cannot stand for table names, column names, or ASC/DESC. Map those choices to a small allowlist controlled by the application. Authentication and tenant authorization remain separate checks.

Example test: a lookup for x' OR '1'='1 must search for that literal value and return no unrelated customers.

Practice follow-up

How would you safely implement a user-selectable sort column?

Sources

OWASP SQL injection prevention.

Related Questions