nerdexam
GIAC

GCIH · Question #17

John works as a Professional Penetration Tester. He has been assigned a project to test the ='or''=' as a username and successfully logs on to the user page of the Web site. Now, John asks the…

The correct answer is C. Use the mysql_real_escape_string() function for escaping input. The login page is vulnerable to SQL injection because user input is passed directly to a SQL query without sanitization. The fix is to escape special characters in user-supplied input before using it in a query.

Web Application Attacks & Post-Exploitation

Question

John works as a Professional Penetration Tester. He has been assigned a project to test the ='or''=' as a username and successfully logs on to the user page of the Web site. Now, John asks the we-aresecure Inc. to improve the login page PHP script. Which of the following suggestions can John give to improve the security of the we-are-secure Website login page from the SQL injection attack?

Options

  • AUse the escapeshellarg() function
  • BUse the session_regenerate_id() function
  • CUse the mysql_real_escape_string() function for escaping input
  • DUse the escapeshellcmd() function

How the community answered

(33 responses)
  • A
    15% (5)
  • B
    6% (2)
  • C
    70% (23)
  • D
    9% (3)

Why each option

The login page is vulnerable to SQL injection because user input is passed directly to a SQL query without sanitization. The fix is to escape special characters in user-supplied input before using it in a query.

AUse the escapeshellarg() function

escapeshellarg() wraps a string in shell quoting for safe use as a shell argument, which has no effect on SQL query construction.

BUse the session_regenerate_id() function

session_regenerate_id() creates a new session ID to mitigate session fixation attacks and is unrelated to sanitizing SQL input.

CUse the mysql_real_escape_string() function for escaping inputCorrect

The mysql_real_escape_string() function escapes special characters such as single quotes and backslashes in a string before it is used in a SQL query, neutralizing the injected SQL syntax. The payload ='or''=' works because unescaped quotes break out of the string context in the query. Applying this function to all user inputs prevents the injected characters from being interpreted as SQL operators.

DUse the escapeshellcmd() function

escapeshellcmd() escapes shell metacharacters to prevent command injection in shell calls, not SQL injection in database queries.

Concept tested: SQL injection prevention via input escaping

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection prevention#input sanitization#PHP security#mysql_real_escape_string

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice