A mass SQL injection attack has infected hundreds of thousands — as many as 500,000, according to some accounts — of normally trusted Web sites, including those of the United Nations and several governments. The attack is unusual in some ways that are worrying the Internet security community.