Which statement best distinguishes SQL injection from NoSQL injection?

• A. SQL injection targets NoSQL stores.
• B. NoSQL injection targets relational databases.
• C. SQL injection targets relational databases; NoSQL injection targets NoSQL stores; risks include data leakage, authentication bypass.
• D. Both injections have identical risk profiles and methods.

Answer: (C)

The main idea here is that SQL injection and NoSQL injection target different kinds of databases and use different query mechanisms. SQL injection happens when an application builds SQL queries by incorporating user input, and that input is crafted to alter the SQL statement run against a relational database. NoSQL injection, on the other hand, targets NoSQL stores and their query languages (often JSON-like or document-oriented queries), where malicious input can modify the constructed query or its operators.

The best choice captures both parts: SQL injection is tied to relational databases and SQL, while NoSQL injection is tied to NoSQL stores and their query formats, with risks such as data leakage and authentication bypass arising from improperly validated input. That aligns with the practical reality that the attack surface is shaped by the database type and its query language.

Why the other options don’t fit: an assertion that SQL injection targets NoSQL stores is incorrect, since SQL injection is specific to relational databases using SQL. Saying NoSQL injection targets relational databases is similarly wrong. And claiming both injections share identical risk profiles and methods ignores the distinct query languages and data models involved, even though both can lead to data leakage or bypassing authentication in some scenarios.