SQL Injection
/ˌɛskjuːˈɛl ɪnˈdʒɛkʃən/S·Q·L in·jec·tionnoun
Definition
1.[in application security] an attack in which text supplied by a user is concatenated into a database query and thereby executed as part of the command rather than treated as a value.
One unparameterised search box exposed the whole users table to SQL injection.
Etymology
From inject, Latin inicere 'to throw in', by analogy with introducing a foreign substance into a body. Described publicly by Jeff Forristal, writing as rain.forest.puppy, in Phrack in 1998.
Antonyms
- parameterised querysense 1 · Relational
References
- Forristal, J. (1998). NT Web Technology Vulnerabilities.Phrack Magazine, 8(54).