Which vulnerability involves injecting crafted input into an SQL query to manipulate database behavior?

• A. Directory Traversal
• B. Cross-Site Scripting
• C. SQL Injection
• D. Buffer Overflow

Answer: (C)

This vulnerability centers on feeding crafted input into an SQL query so the database executes unintended commands. When an application builds an SQL statement by directly concatenating user-supplied data, the input can terminate the current string and inject additional SQL logic. That can alter the query’s meaning, allow data to be read or modified, or even bypass authentication. For example, a login form might be tricked into always authenticating a user if input is crafted to make the WHERE clause true, or an attacker could append a UNION SELECT to extract data from other tables.

The standard defense is using parameterized queries (prepared statements) so user input is treated strictly as data, not executable SQL. Pair that with least-privilege database accounts, input validation, proper error handling, and, where appropriate, stored procedures or ORM safeguards. This way, even if input contains SQL syntax, it cannot change the structure of the query.

Other options describe different issues: Directory traversal targets file system access, Cross-Site Scripting injects code for clients, and Buffer Overflow concerns memory safety—not SQL manipulation.