Security · Question 5 of 12
What is SQL injection?
1 answer is correct. Easy
Show answer
Answer
- A Input is built into an SQL query in a way that changes its meaning
Explanation
In SQL injection, a value from the request is pasted directly into the SQL text, for example "WHERE title = '" . $title . "'". If an attacker enters ' OR '1'='1, the query suddenly returns all records, or worse, deletes or reads other data. In TYPO3 you prevent this by passing values in the QueryBuilder with createNamedParameter() or by using the Extbase query; the values then reach the database separately from the SQL text. Overloading with many requests is a denial-of-service attack and has nothing to do with injecting SQL.