What is SQL injection and why is it important for web app testing?

• A. SQL injection is a defense mechanism.
• B. SQL injection is input manipulation to execute malicious SQL, enabling data access or modification; critical to test for data leakage.
• C. SQL injection is a technique to bypass FTP.
• D. SQL injection is about injecting HTML into SQL.

Answer: (B)

SQL injection happens when an application builds SQL queries using input from users without treating that input as data. By injecting specially crafted input into forms, query strings, or parameters, an attacker can alter the logic of the SQL being executed, potentially retrieving, modifying, or deleting data, or even bypassing authentication.

This matters for web app testing because it directly affects the integrity and confidentiality of the database. A tester looks for places where input is interpolated into SQL and verifies that queries are parameterized or properly escaped, that inputs are validated, and that the application uses least-privilege database accounts. Typical tests try inputs that would alter the query’s meaning, to see if the app leaks data or grants access incorrectly; successful prevention hinges on using prepared statements, parameterized queries, and robust input handling.

Other options don’t fit because this vulnerability is not a defense mechanism, not related to bypassing FTP, and not about injecting HTML into SQL.