A city portal stores a citizen nickname that is later reused in a different admin report query. Injection fails on the registration request but succeeds when staff generate that report. What injection class best fits this pattern?
Select an answer to reveal the explanation.
Short Explanation
Picture writing a note that looks harmless when you drop it in the inbox — then it blows up when someone else reads it into a search. Second-order SQLi is that delayed fuse: the bad string sits in storage and only runs when a later query trusts it. The first request can look clean and still leave a landmine.
Full Explanation
Second-order SQL injection occurs when untrusted data is persisted safely enough to pass the initial request, then concatenated or otherwise insecurely reused in a subsequent query. Testers must follow data flow beyond the entry point and retest contexts such as admin reports, batch jobs, and search features. Immediate-request SQLi testing alone can miss this class. XSS and CSRF are different abuse models and do not explain delayed query execution of stored input.