Databases
Database knowledge supports both direct assessment and web injection testing. Understand the relational model: tables, rows, columns, primary keys (uniquely identify a row), foreign keys (referential integrity), and indexes (performance, not security). Know basic SQL statement categories: SELECT (read), INSERT/UPDATE/DELETE (modify), and DDL such as CREATE/ALTER. Understand that a DBMS account has privileges, and least privilege limits what an injection can achieve.
For security, know the difference between the application account and administrative accounts, and why the app should not connect as a highly privileged user. Understand SQL injection conceptually: input alters query structure; the classic condition is a tautology (always-true) versus a false condition, and time-based confirmation via deliberate delay. Know that parameterized queries (prepared statements) are the primary defence, with input validation and least privilege as supporting controls. Recognize that NoSQL and other stores have analogous injection concepts.
Trap: questions may confuse a primary key with a foreign key, or claim that input validation alone fully prevents injection - it does not; parameterization is the robust fix. Another trap is assuming error messages are harmless; verbose DB errors leak structure.
Rule of thumb: when asked how to prevent SQL injection, the answer is parameterized queries first; validation and least privilege reduce impact but do not replace it.