Building RESTful Web Services with .NET Core

SQL injection attacks

An SQL injection attack is one of the most severe attacks that directly target the database. This is first in the list of OWASP application security risks. Attackers can steal a system's secured data with the help of SQL injection.

The following diagram shows the process of SQL injection:

In the preceding diagram, you can see a typical SQL injection scenario where the attacker has injected an or clause to fetch all of the data of a particular table. The actual code instruction was to return a single record based on the EmpId from the employee table. But as it was injected with an extra phrase, it returns the complete ...