thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Second-Order SQL Injection

SQL injection in which malicious input is stored safely first and later used unsafely in another query.

Definition

The initial insert may be parameterized, but a later process (such as a report or password change) reads the stored value and concatenates it into SQL. Defenses require parameterizing every query, including those that use data from the database.

Example

A username saved at registration is later concatenated into an UPDATE statement by a nightly job.

Exam tip

Data from your own database is still untrusted when building queries.

Related terms