App Vulnerabilities + Controls

2. SQL Injection: On Slide 5 above, we mentioned the threat of direct access to a database (not through the interface application,) which may cause data corruption and disclosure of confidential information. This attack attempts to do exactly that!
   
   SQL injection, which is an instance of a group of attacks called code injections is an attempt of an attacker to read from, write to, or re-configure a database illegally. SQL (Structured Query Language) is a programming language using which programmers communicate instructions to databases. In such an attack, the attacker will type SQL code into an input textbox (e.g., search box, username textbox, password textbox, etc.) and hope that the entered code will achieve its purpose.
   
   An SQL injection attack might succeed when the website or web app doesn't properly validate the format of its data. For example, most programming languages used for server development, e.g., Java, Python, PHP, etc., come with library functions that 'escape' special SQL characters in user data to minimize SQL injection chances.