Sql injection occurs when
-
Data is injected from application into query
-
The data is used to dynamically construct a SQL query
-
when sql query is executed injected application code from the database.
-
None of these
SQL injection occurs when user-supplied data is used to dynamically construct SQL queries without proper validation or parameterization, allowing attackers to manipulate query structure. Option A describes the flow but not the vulnerability mechanism. Option C describes a different scenario. SQL injection is specifically about the DYNAMIC construction of queries from untrusted input.
SQL injection occurs when untrusted, attacker-controlled input is concatenated or interpolated directly into a SQL query string that is then dynamically built and executed, letting the attacker alter the query's logic (e.g., adding OR 1=1 or a UNION SELECT). Using parameterized queries/prepared statements instead of dynamic string construction is the standard defense.