What is data injection?
Definition
Data injection is an attack where someone feeds malicious or fake input into a program, such as a web form or an identity check, so that it runs unintended commands or accepts something false as genuine.
- Category
- Attacks
- Also called
- injection attack, SQL injection
- Last updated
"Data injection" is a loose term, and it covers a few related attacks. The common idea is the same: a system trusts input it shouldn't, and an attacker uses that.
SQL injection
The classic version. NIST describes SQL injection as attacks that look for websites that pass insufficiently processed user input to database back-ends. A login box expects a username. An attacker types database commands instead. If the site doesn't check the input, the database runs them, and the attacker can read, change or delete records, including customer names, emails and password hashes.
Injection against identity checks
NIST's digital identity guidance (SP 800-63-4) defines an injection attack in a second, newer sense: supplying untrusted biometric information or media into a process, for example a falsified image of identity evidence, a forged video of a user or a morphed image, to beat a check that verifies who you are. That's the route behind some deepfake-based account fraud.
Why it matters to you
You can't stop a company from being vulnerable. But injection attacks are one way data breaches happen, and your details end up in the stolen database. In the identity version, a fraudster can get past a check using fake media of you.
Injection vs. a data breach
Injection is the method. The breach is the result. A company can be breached by injection, by phishing or by a stolen password.
How to protect yourself
- 1
Use a unique password for every account
If an injection attack leaks a site's database, a password you reused elsewhere is the real risk. A password manager makes unique ones easy.
- 2
Turn on two-factor authentication
A leaked password alone then can't open the account.
- 3
Act fast on breach notices
If a company tells you your data was exposed, change the password and watch your accounts and credit reports for odd activity.
- 4
Keep your details off public lists
Less exposed data means less to match against a leaked database. Serus finds where your address and phone number are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between data injection and SQL injection?
SQL injection is the best known type, aimed at a website's database. Data injection is the wider idea of feeding bad input into any system.
Can a data injection attack steal my data?
Yes, if the system holds your data and doesn't check its input. The attacker can read records straight from the database.
How do companies prevent injection attacks?
By checking and cleaning all user input and by separating commands from data. As a user you can't fix this, so limit the damage with unique passwords and two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.