What does the attacker do in a SQL Injection attack?

A SQL Injection (SQLi) attack is a code injection technique where an attacker inserts or "injects" a malicious SQL query via the input data from the client to the application. A successful SQLi exploit can read sensitive data from the database, modify database data, execute administration operations on the database, and in some cases, issue commands to the operating system. The core of the attack is the submission of a string that the backend database server parses and executes as an unintended SQL command because the application failed to properly sanitize the user input.

A. This describes a potential outcome or goal of a SQL injection attack, not the fundamental action the attacker takes to perform it.
B. SQL injection is primarily an application-layer vulnerability, exploiting how the application constructs queries, not necessarily a specific database software vulnerability.
C. The attack is typically performed through standard, documented user input channels like web forms or URL parameters, not necessarily undocumented administrative interfaces.

1. Python Official Documentation, sqlite3 — DB-API 2.0 interface for SQLite databases: In the "Security considerations" section, the documentation warns against using string formatting to build queries because it makes the application "vulnerable to an SQL injection attack." It explains that an attacker can "supply a string that will be interpreted as an SQL command," which directly supports the correct answer. (Source: Python 3.12.3 documentation, sqlite3 module, Security considerations section).

2. MIT OpenCourseWare, 6.858 Computer Systems Security, Fall 2014: Lecture 10 notes on Web Security describe SQL injection as an attack where user-provided input is "interpreted as code" by the SQL server. The notes state, "The problem: mixing code and data... Attacker can provide input that gets interpreted as code." This aligns perfectly with the attacker submitting a string that is interpreted as a command. (Source: MIT OCW, 6.858, Fall 2014, Lecture 10: Web Security, Page 11).

3. Halfond, W. G., Viegas, J., & Orso, A. (2006). A classification of SQL-injection attacks and countermeasures. Proceedings of the International Symposium on Secure Software Engineering. This academic paper defines SQL injection as a vulnerability where an application "incorrectly constructs a SQL statement by mixing data and control." The attacker provides input that "modifies the SQL statement that is executed." (DOI: https://doi.org/10.1109/ISSSE.2006.241677, Section 2.1).