Injection flaws are web application vulnerabilities that allow untrusted data to be interpreted and executed as part of a command or query. Which injection flaw involves injecting malicious code through a web application?

Injection flaws are web application vulnerabilities that allow untrusted data to be interpreted and executed as part of a command or query. Which injection flaw involves injecting malicious code through a web application?

• A. SQL Injection
• B. Password brute force
• C. Nmap Scanning
• D. Footprinting

Answer: (A)

Injection flaws occur when untrusted input is treated as code by an interpreter, turning user data into part of a command or query. In web applications, the most common form is SQL injection, where malicious SQL is injected through a user input field and executed by the database because the app builds queries by concatenating strings without safe parameterization or escaping. This can allow an attacker to read, modify, or delete data, or even bypass authentication. The other options describe different kinds of attacks: password brute force aims to guess credentials, Nmap scanning is about discovering network hosts and services, and footprinting is an information-gathering step; none specifically describe injecting code through a web application’s data input like SQL injection does.

Injection flaws occur when untrusted input is treated as code by an interpreter, turning user data into part of a command or query. In web applications, the most common form is SQL injection, where malicious SQL is injected through a user input field and executed by the database because the app builds queries by concatenating strings without safe parameterization or escaping. This can allow an attacker to read, modify, or delete data, or even bypass authentication. The other options describe different kinds of attacks: password brute force aims to guess credentials, Nmap scanning is about discovering network hosts and services, and footprinting is an information-gathering step; none specifically describe injecting code through a web application’s data input like SQL injection does.