SQL and XML Injections

Question 1

What is an Injection Attack?

Answer 1

Involves sending malicious data to a system for unintended consequences

Question 2

What is a Code Injection?

Answer 2

The insertion of additional information or code through a data input form from a client to an application

Question 3

What is an SQL Injection?

Answer 3

Involves inserting malicious SQL code into input fields

Question 4

What is an XML Bomb (Billion Laughs Attack)?

Answer 4

XML consumes memory exponentially by encoding entities that expand to big sizes, acting like a denial-of-service attack

Question 5

What is an XXE (XML External Entity) Attack?

Answer 5

Attempts to read local resources, like password hashes in the shadow file

Question 6

What are the ways to defend against SQL and XML attacks?

Answer 6

Input Validation and Input Sanitization