injection attacks - terminology

Question

I have a question related to injection attacks like SQL injections and command injections.

I have a good grasp about how those attacks are performed, but I would like to know where the term injection comes from.

Is that because the attacker injects (inserts) malicious code/commands into the data sent to the application?

Answer 1

Yes, it is injection because you are injecting your code into the existing SQL code.

For example. A common way to log a user in using php and SQL looks like this:

$sql = "SELECT * FROM users WHERE username = '" . $POST['username'] . "' AND password = '" . $POST['password'] . "';"

The variables $POST['username'] and $POST['password'] what the user puts in the login fields. If the user entered the following.

' or 1 == 1 ---

The resulting SQL that is executed looks like this:

SELECT * FROM users WHERE username = '' or 1 == 1 --- AND password = '';

Notice that everything after the "---" is a comment and ignored. So the sql looks to see if it can find a username that matches null or 1 == 1. Since 1 always equals 1, the SQL will return true and log the user in.

This is called injection because the user is injecting their code into the code the developer wrote.

Answer 2

It's just a word. The word's etymology is about something being 'introduced' which fits the purpose.