thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Application & OT Security

SQL Injection vs Command Injection: What's the Difference?

SQL injection inserts malicious SQL into a database query to read, modify, or delete data. OS command injection inserts shell commands into a system call so they execute on the server's operating system.

SQL Injection

Full definition
vs

OS Command Injection

SQL InjectionOS Command Injection
Interpreter targetedDatabase engineOperating system shell
Telltale input' OR 1=1 --, UNION SELECT; whoami, && cat /etc/passwd, | ping
Typical impactData theft, authentication bypass, data tamperingFull server compromise, remote code execution
Primary defenseParameterized queries/prepared statementsAvoid shell calls; use safe APIs with argument arrays
Secondary defenseLeast-privileged DB accounts, input validation, WAFInput allow-listing, least-privileged service account
Remember it

SQLi talks to the database; command injection talks to the shell.

Exam tip

Spot the syntax: quotes and SQL keywords mean SQL injection; semicolons, pipes, and OS commands mean command injection. Parameterized queries are the top answer for SQLi.

Tested on

More Application & OT Security look-alikes