Differentiate SQL injection and NoSQL injection and give a risk example for each.

• A. NoSQL injection targets relational databases.
• B. SQL injection and NoSQL injection have identical risks.
• C. SQL injection targets relational databases; NoSQL injection targets NoSQL stores; risks include data leakage, authentication bypass.
• D. NoSQL injection can only occur in non-authenticated systems.

Answer: (C)

SQL injection and NoSQL injection exploit similar ideas on different data stores: they both rely on unsafely incorporating user input into queries, but the targets and the query languages differ. In relational databases, inputs are often concatenated into SQL strings, so crafted input can alter the query’s logic. A common risk is authentication bypass on a login form, where the input makes the WHERE clause always true, letting an attacker gain access without valid credentials. In NoSQL stores, queries are built from structured data like JSON, and unvalidated user input can modify query operators or conditions. A typical risk here is data leakage, where an attacker constructs input that retrieves documents or records they shouldn’t be allowed to see. These examples show how injections manifest across different database types, emphasizing the need for proper input validation and safe query construction in both contexts.