Question
Describe how an SQL injection attack works and state one method of preventing it. [4 marks]
Mark scheme (4): Up to 3 for description, 1 for prevention.
- Attacker enters SQL code / commands into an input field (e.g. login form / search box) [1]
- The database executes the injected code as part of its query [1]
- This can return, modify or delete data the attacker should not access (e.g. bypass login with
' OR '1'='1) [1] - Prevention (1 mark, any one): input validation / sanitisation; parameterised queries / prepared statements; restrict database user privileges; use of stored procedures. Do not credit "firewall" or "anti-virus".
4 marks · take your time before peeking.
Sign up to try the next 30 problems
Save your streak, mark answers against the spec, and build a daily revision habit. Free during public beta — no card, no auto-renew.
Generated by TopMyGrade AI · cross-check official sources before relying on the mark-scheme phrasing.