nerdexam
EC-Council

312-50V13 · Question #502

You're the security manager for a tech company that uses a database to store sensitive customer data. You have implemented countermeasures against SQL injection attacks. Recently, you noticed some…

The correct answer is C. OR 'a'='a; DROP TABLE members; --: This payload combines the manipulation of the WHERE. The payload OR 'a'='a; DROP TABLE members; -- has the most significant impact as it can lead to both authentication bypass and catastrophic data loss.

Submitted by daniela_cl· Mar 6, 2026SQL Injection

Question

You're the security manager for a tech company that uses a database to store sensitive customer data. You have implemented countermeasures against SQL injection attacks. Recently, you noticed some suspicious activities and suspect an attacker is using SQL injection techniques. The attacker is believed to use different forms of payloads in his SQL queries. In the case of a successful SQL injection attack, which of the following payloads would have the most significant impact?

Options

  • A'OR 'T="1: This payload manipulates the WHERE clause of an SQL statement, allowing the
  • B'OR username LIKE '%': This payload uses the LIKE operator to search for a specific pattern in a
  • COR 'a'='a; DROP TABLE members; --: This payload combines the manipulation of the WHERE
  • DUNION SELECT NULL, NULL, NULL -- : This payload manipulates the UNION SQL operator,

How the community answered

(23 responses)
  • A
    22% (5)
  • B
    4% (1)
  • C
    65% (15)
  • D
    9% (2)

Why each option

The payload `OR 'a'='a; DROP TABLE members; --` has the most significant impact as it can lead to both authentication bypass and catastrophic data loss.

A'OR 'T="1: This payload manipulates the WHERE clause of an SQL statement, allowing the

The payload `'OR 'T="1'` (likely `OR 1=1`) is an authentication bypass, allowing unauthorized access, but it does not directly cause data destruction.

B'OR username LIKE '%': This payload uses the LIKE operator to search for a specific pattern in a

The payload `'OR username LIKE '%''` is also typically used for authentication bypass or data enumeration, but it does not lead to data deletion.

COR 'a'='a; DROP TABLE members; --: This payload combines the manipulation of the WHERECorrect

This payload combines an authentication bypass condition (`OR 'a'='a'`) with a data destruction command (`DROP TABLE members;`). The `DROP TABLE` command permanently deletes an entire table and all its contents, causing irreversible data loss, which represents the most significant impact among the choices.

DUNION SELECT NULL, NULL, NULL -- : This payload manipulates the UNION SQL operator,

The payload `UNION SELECT NULL, NULL, NULL --` is primarily used for data exfiltration by combining query results, not for deleting data or causing severe system damage.

Concept tested: Impact of SQL injection payloads (data destruction)

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/sql-injection

Topics

#SQL injection#database security#payloads#data integrity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice