Arrange the steps of a SQL injection authentication bypass in chronological order, from first to last: - The application grants unauthorized access based on the query result - The database parses and executes the altered query logic - The application concatenates the unvalidated input into a SQL query - The attacker submits crafted input containing SQL syntax into a login form

### The order 1. **The application constructs a query**: the login form is connected to a database operation. 2. **The attacker supplies crafted input**: the input is accepted by the vulnerable application. 3. **The query logic is altered**: unsafe construction allows the input to affect the command. 4. **The application processes the altered query**: the database evaluates the changed instructions, potentially changing the authentication result. ### Terms - **Query**: a request that asks a database to retrieve or process information. - **Authentication**: verifying a user's claimed identity. ### Remember The vulnerability depends on input changing the query before the database processes it.