In a vulnerable login scenario, a query containing DROP TABLE demonstrates what kind of vulnerability?

In a vulnerable login scenario, a query containing DROP TABLE demonstrates what kind of vulnerability?

• A. Deletes the entire members table
• B. Retrieves data
• C. Causes a syntax error
• D. Does nothing

Answer: (A)

SQL injection occurs when untrusted input is not properly sanitized and is treated as part of an SQL statement. In a vulnerable login, injecting a DROP TABLE command shows the attacker can cause the database to execute arbitrary SQL, including commands that alter the database structure. The DROP TABLE statement is a data definition language command that deletes an entire table; if the database executes it, the members table can be removed, illustrating a destructive outcome from an injection vulnerability. This is not merely about retrieving data or causing a syntax error—the payload demonstrates that the application trusts user input enough to run it as SQL, enabling harmful actions like dropping tables. The real defense is using parameterized queries and strict least-privilege database accounts to prevent such execution, ensuring inputs are not treated as executable SQL.

SQL injection occurs when untrusted input is not properly sanitized and is treated as part of an SQL statement. In a vulnerable login, injecting a DROP TABLE command shows the attacker can cause the database to execute arbitrary SQL, including commands that alter the database structure. The DROP TABLE statement is a data definition language command that deletes an entire table; if the database executes it, the members table can be removed, illustrating a destructive outcome from an injection vulnerability. This is not merely about retrieving data or causing a syntax error—the payload demonstrates that the application trusts user input enough to run it as SQL, enabling harmful actions like dropping tables. The real defense is using parameterized queries and strict least-privilege database accounts to prevent such execution, ensuring inputs are not treated as executable SQL.