Can you describe an SQL injection attack? What measures can be taken to prevent it?
This is a hybrid of a technical and operational question. You first have to define a specific term and then describe how you would address it. During the interview process, hybrid questions are typical for a back end developer's position. Like their individual components, a hybrid operational and technical question should be answered briefly and to the point. You should also anticipate follow-up questions indicating that the topic is important to the interviewer and they want to explore it in more depth.
"A SQL injection attack is a common form of an attack in which a hacker takes advantage of a lack of separation between a program code and information input by the user. This allows the hacker to inject malicious code into the program. With this specific type of attack, the code is provided via SQL queries. There are several ways you can prevent this type of attack. These include careful definitions of the type of queries that can be made, storing procedures, and validating the users' input."
Community answers are written by other candidates practicing this set. Reading how others frame the same question is one of the fastest ways to sharpen your own.
Anonymous Answer
Malicious SQL statements sent to servers are intended to corrupt the database or expose sensitive data. This is sometimes done by entering the SQL code as input on a webpage form so that the inputted SQL is run as part of an existing SQL query on the application's database. A lack of separation between server code and user input exposes this vulnerability which can be mitigated by validating user input and defining the types of queries that can be made at the database level.
Marcie's Feedback
It sounds like you know what a SQL injection attack is and what can be done to prevent it. Nice! Consider researching and discussing some real-life SQL injection attacks that have occurred to further impress the interviewer.
Unlock all 30 Back End Developer questions
Unlock expert responses to technical questions that separate senior from junior developers.
Get Started