Structured Query Language (SQL) injection is a type of attack that exploits a vulnerability in a web application that allows an attacker to execute malicious SQL commands on a database server. SQL injection can result in data theft, data corruption, unauthorized access, or denial of service. The best way to protect against SQL injection is to use stored procedures, which are precompiled and parameterized SQL statements that are stored on the database server. Stored procedures prevent SQL injection by separating the user input from the SQL code, and by validating and sanitizing the user input before executing the SQL statement. Stored procedures also improve the performance and maintainability of the web application, as they reduce the network traffic and the code complexity. Other ways to protect against SQL injection are to enforce boundary checking, which limits the length and format of the user input, to restrict the use of SELECT command, which retrieves data from the database, and to restrict the HyperText Markup Language (HTML) source code, which displays the web page content. References: [Official (ISC)2 Guide to the CISSP CBK, Fifth Edition], Chapter
8: Software Development Security, page 403. CISSP All-in-One Exam Guide, Eighth Edition, Chapter 9:
Software Development Security, page 527.