SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-sql-injection

Which web attack inserts a database query into an input field that the application then runs?

SQL injection, user input becomes part of a database command.

Start playing free

  1. Cross-site scripting
  2. SQL injection ✔
  3. Directory traversal

Why: If an app builds queries by pasting in user text, attackers can add their own SQL. Successful attacks can read, change or delete data.

Huh, didn't know that: OWASP says parameterized SQL statements require less maintenance and can offer more security guarantees than input allow lists.

The dad joke
An SQL statement walks into a bar and sees two tables. It asks, "May I join you?"
Like this card?
Play the game

References

Answer: SQL injection. If an app builds queries by pasting in user text, attackers can add their own SQL. Successful attacks can read, change or delete data.

  1. OWASP, SQL Injection owasp.org/www-community/attacks/SQL_Injection
    A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application.
    Checked 2026-10-10.
  2. OWASP, SQL Injection owasp.org/www-community/attacks/SQL_Injection
    parameterized SQL statements require less maintenance and can offer more guarantees with respect to security
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich web attack injects malicious scripts into otherwise trusted websites so they run in other users' browsers?Security & PrivacyWhich attack forces a logged-in user's browser to perform an action they did not intend?Security & PrivacyUsing sequences like ../ to reach files outside a web application's folder is called what?

That's stuff everyone should know.