Injection Flaws include which types of injection?

Injection Flaws include which types of injection?

• A. SQL, code, and command are different types of injection attacks
• B. They are not related to databases
• C. They only affect client-side scripting
• D. They always require physical access

Answer: (A)

Injection flaws occur when untrusted input is passed to an interpreter (like a database, a shell, or a runtime) without proper validation, causing that input to be executed as part of a command, query, or code. This is why SQL injection, command injection, and code injection are all considered different forms of injection attacks: each involves the same underlying risk—untrusted data being treated as executable instructions in a different context. The other statements don’t fit because injection is not limited to databases (SQL is one context), it can affect server-side processes as well as client-side, and it does not require physical access to be exploited.

Injection flaws occur when untrusted input is passed to an interpreter (like a database, a shell, or a runtime) without proper validation, causing that input to be executed as part of a command, query, or code. This is why SQL injection, command injection, and code injection are all considered different forms of injection attacks: each involves the same underlying risk—untrusted data being treated as executable instructions in a different context. The other statements don’t fit because injection is not limited to databases (SQL is one context), it can affect server-side processes as well as client-side, and it does not require physical access to be exploited.