Differences between SQL injection and XSS attack

[✨ Megiddo]

Differences between SQL injection and XSS attack​

Even though both SQL injection and XSS attack are common web hacking techniques, there are a few key differences between the two.

	SQL injection attack	Cross-site scripting attack
Attack definition	An attack technique where attackers target data-driven applications and compromise user/organization databases by performing certain actions.	An attack technique where attackers execute malicious code in the victim users browsers which they can control.
Entry point	The initial access in SQL attack is achieved through drive-by compromise technique.	The initial access in XSS attack is achieved through exploiting public-facing application technique.
Attack technique	The attacker injects malicious SQL queries into web form input field.	The attacker injects malicious client-side scripts into webpages/websites.
Impact	Upon successful execution, the attacker can add, delete, or modify the existing database and bypass the security controls.	Upon successful execution, the attacker can perform session hijacking, credential theft, data exfiltration, impersonate victim user, account hijacking, etc.
Attack language	The most common language used in the attack is SQL.	The most common language used in the attack is JavaScript.

Although SQL injection and cross-site scripting attack continue to be popular among attackers, continuous monitoring, testing, and deploying the best preventive measures will help organizations keep their websites from becoming prey to such attacks and neutralize any threats preemptively.