Is the following code vulnerable to SQL Injection ($mysqli is an instance of the MySQLi class)?
```php
$age = $mysqli-real_escape_string($_GET['age']);
$name = $mysqli-real_escape_string($_GET['name']);
$query = "SELECT * FROM 'table' WHERE name LIKE '$name' AND age = $age";
$results = $mysqli-query($query);
```

Question

Is the following code vulnerable to SQL Injection ($mysqli is an instance of the MySQLi class)?
```php
$age = $mysqli->real_escape_string($_GET['age']);
$name = $mysqli->real_escape_string($_GET['name']);
$query = "SELECT * FROM 'table' WHERE name LIKE '$name' AND age = $age";
$results = $mysqli->query($query);
```

Accepted Answer

D. Yes, because the $age variable is improperly escaped.

Answer

A. No, the code is fully protected from SQL Injection.

Answer

B. Yes, because the $name variable is improperly escaped.

Answer

C. Yes, because the $name variable and the $age variable is improperly escaped.

Answer

E. Yes, because you cannot prevent SQL Injection when using MySQLi

Is the following code vulnerable to SQL Injection ($mysqli is an instance of the MySQLi class)? ``php $age = $mysqli->real_escape_string($_GET['age']); $name =…

Question

Options

How the community answered

Topics

Community Discussion