GCIH · Question #115
Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.
The correct answer is A. mysql_real_escape_string() D. Prepared statement. SQL injection is mitigated by escaping user input with mysql_real_escape_string() or, more robustly, by using prepared statements that separate SQL logic from user-supplied data.
Question
Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.
Options
- Amysql_real_escape_string()
- Bsession_regenerate_id()
- Cmysql_escape_string()
- DPrepared statement
How the community answered
(32 responses)- A94% (30)
- B3% (1)
- C3% (1)
Why each option
SQL injection is mitigated by escaping user input with mysql_real_escape_string() or, more robustly, by using prepared statements that separate SQL logic from user-supplied data.
mysql_real_escape_string() escapes special characters such as single quotes and backslashes in a string before it is included in an SQL query, preventing those characters from being interpreted as SQL syntax and blocking injection.
session_regenerate_id() is a PHP function that generates a new session ID to prevent session fixation attacks and has no effect on SQL injection vulnerabilities.
mysql_escape_string() is a deprecated PHP function that does not account for the current character set of the database connection, making it less reliable and potentially bypassable compared to mysql_real_escape_string().
Prepared statements (parameterized queries) are the strongest defense against SQL injection because they precompile the SQL structure on the server, ensuring that any user-supplied input is always treated as a data value and never as executable SQL code.
Concept tested: SQL injection prevention using escaping and parameterized queries
Source: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
Topics
Community Discussion
No community discussion yet for this question.