What is SQL injection, and what are common defensive strategies to prevent it in web applications?

• A. It's solved by using strong passwords
• B. Injecting malicious SQL via unsanitized input; defenses include parameterized queries, input validation, least-privilege DB accounts, WAF, and secure coding.
• C. It is a hardware vulnerability
• D. It occurs only with NoSQL databases

Answer: (B)

SQL injection happens when an attacker sends malicious SQL through an input that isn’t properly cleaned, causing the application to combine that input with its query in a way that makes the database execute unintended commands. The defenses listed are effective because they address the root problem: how the app builds queries.

Parameterized queries (prepared statements) separate code from data so inputs are treated strictly as values, not executable SQL. Input validation helps catch dangerous inputs before they reach the query. Limiting the database account to the minimum privileges needed restricts what an attacker could do if injection succeeds. A web application firewall adds an extra line of defense by blocking suspicious payloads. Secure coding practices, including avoiding dynamic SQL and using safe APIs, reduce the chance of introducing vulnerable code in the first place.

Stronger passwords don’t prevent SQL injection, since the issue is how queries are formed rather than how users authenticate. It’s not a hardware vulnerability. And while there are injection threats in some NoSQL systems, SQL injection specifically targets SQL-based databases, not all NoSQL environments.