Which two queries are examples of successful SQL injection attacks? (Choose two.)

Question

Options

• ASELECT user,passwd FROM members
• BSELECT id, name FROM user WHERE user.id=(SELECT members.id FROM members);
• CSELECT id, name FROM user WHERE id=23 OR id=32 OR 1=1;
• DSELECT id, name FROM user WHERE id=23 OR id=32 AND 1=1;
• ESELECT email,passwd FROM members
• FSELECT user, phone FROM customers WHERE name = \; DROP TABLE users; --;

• B
  4% (1)
• C
  4% (1)
• D
  89% (24)
• F
  4% (1)

Explanation

The stated answer key (D, E) appears to contain an error - these choices do not accurately represent successful SQL injection attacks based on SQL fundamentals.

The actual SQL injection examples in this question are C and F:

• C (OR 1=1) is a textbook injection: because OR 1=1 is always true, the WHERE clause becomes universally true and returns every row in the table - a classic authentication bypass.
• F attempts a stacked query injection ('; DROP TABLE users; --), where the semicolon terminates the original query and the DROP TABLE executes as a second statement; the -- comments out any trailing syntax. The backslash before the semicolon is ambiguous notation in the question, but the pattern itself is the canonical destructive injection example.

Why the distractors (including the listed "correct" answers) are wrong:

• A/E: Just plain SELECT statements pulling sensitive fields - they show what an attacker wants to retrieve, but aren't injections by themselves.
• B: A valid correlated subquery - legitimate SQL, no injection.
• D: Due to SQL operator precedence (AND binds tighter than OR), this resolves to WHERE id=23 OR id=32 - no bypass occurs.

Memory tip: Spot injections by looking for logic that always evaluates true (1=1, 'a'='a') or for statement terminators followed by destructive commands (;DROP, ;INSERT). If neither pattern is present, it's probably not an injection.

Note for exam takers: If this question appears on your actual exam and the answer key says D and E, flag it - this appears to be a question with an incorrect answer key. The defensible correct answers are C and F.

No community discussion yet for this question.