SQL Injection: A Demonstration and Implications for Accounting Students

ABSTRACT The purpose of this paper is to present a pedagogical case that demonstrates how a prevalent cybersecurity threat, SQL Injection (SQLi), operates. Prompted by questions from students such as: “How do cybersecurity threats work?” and “What specific actions can organizations take to mitigate cybersecurity threats?”, this paper demonstrates the technical inner-working of SQLi. Students first answer background questions on SQLi and then simulate SQLi in both a Microsoft Access and web-based environment.