CAS-001 · Question #498
select id, firstname, lastname from authors User input= firstname= Hack;man lastname=Johnson Which of the following types of attacks is the user attempting?
The correct answer is D. SQL injection. This is a SQL injection attack (D). The user has entered a semicolon (;) within the firstname input field. In SQL, a semicolon is a statement terminator. If the application unsafely concatenates user input directly into a SQL query, the injected semicolon could terminate the…
Question
select id, firstname, lastname from authors User input= firstname= Hack;man lastname=Johnson Which of the following types of attacks is the user attempting?
Options
- AXML injection
- BCommand injection
- CCross-site scripting
- DSQL injection
How the community answered
(63 responses)- A5% (3)
- B6% (4)
- C2% (1)
- D87% (55)
Explanation
This is a SQL injection attack (D). The user has entered a semicolon (;) within the firstname input field. In SQL, a semicolon is a statement terminator. If the application unsafely concatenates user input directly into a SQL query, the injected semicolon could terminate the original SELECT statement and allow the attacker to append a second malicious SQL statement (e.g., DROP TABLE, INSERT, or SELECT of sensitive data). This is a classic SQL injection technique. It is not XSS (C) since there are no script tags targeting a browser. It is not command injection (B) since the target is a database engine, not an OS shell. It is not XML injection (A) since no XML structures are involved.
Topics
Community Discussion
No community discussion yet for this question.