About this interactive
What you are doing: naming the injection attack by where the unchecked input ends up.
All three feed input into a place it should not reach, and the destination tells them apart. Command injection runs the input as an operating-system command on the host. SQL injection makes the input part of a database query, so it returns or changes records it should not. Cross-site scripting gets the input rendered as live script in another user's browser. The fix for all three is the same idea: treat input as data, never as instructions.
How to use it: ask where the input lands. The host operating system, the database query, or another person's browser?
What you'll learn
- Name the injection attack from where the unchecked input ends up: an operating-system command, a database query, or a script in another user's browser
Aligned to
CompTIA Security+
2.3
Explain various types of vulnerabilities.
2.4
Given a scenario, analyze indicators of malicious activity.
Key terms
- Command Injection
- A type of injection attack where an attacker inserts operating system commands into an input field to execute unauthorized commands on the host system.
- SQL Injection
SQLi
- An attack that inserts malicious SQL code into a query to manipulate a database.
- Cross-Site Scripting
XSS
- Cross-Site Scripting is a web application attack in which malicious scripts are injected into trusted web pages and executed in the browsers of unsuspecting users, enabling session hijacking, credential theft, and unauthorized actions on behalf of the victim.
- Injection Attack
- An attack where malicious input is inserted into an application's input fields to execute unauthorized commands or manipulate system behavior.
Topics
Command Injection
Sql Injection
Cross Site Scripting
Interactive
Categorize
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →