Is the following code vulnerable to SQL Injection ($mysqli is an instance of the MySQLi class)? $age = $mysqli-real_escape_string($_GET['age']); $name = $mysqli-real_escape_string($_GET['name']); $query = "SELECT * FROM `table` WHERE name LIKE '$name' AND age = $age"; $results = $mysqli-query($query);

Question

Is the following code vulnerable to SQL Injection ($mysqli is an instance of the MySQLi class)? $age = $mysqli->real_escape_string($_GET['age']); $name = $mysqli->real_escape_string($_GET['name']); $query = "SELECT * FROM `table` WHERE name LIKE '$name' AND age = $age"; $results = $mysqli->query($query);

Accepted Answer

D. Yes, because the $age variable is improperly escaped.

Answer

A. No, the code is fully protected from SQL Injection.

Answer

B. Yes, because the $name variable is improperly escaped.

Answer

C. Yes, because the $name variable and the $age variable is improperly escaped.

Answer

E. Yes, because you cannot prevent SQL Injection when using MySQLi

Is the following code vulnerable to SQL Injection ($mysqli is an instance of the MySQLi class)? $age = $mysqli->real_escape_string($_GET['age']); $name = $mysqli->real_escape_string($_GET['name'])…

Question

Options

How the community answered

Community Discussion