nerdexam
GIAC

GCIH · Question #192

You run the following PHP script: <?php $name = mysql_real_escape_string($_POST["name"]); $password = mysql_real_escape_string($_POST["password"]); ?> What is the use of the…

The correct answer is B. It can be used as a countermeasure against a SQL injection attack. D. It escapes all special characters from strings $_POST["name"] and $_POST["password"]. The mysql_real_escape_string() function escapes SQL-special characters in user input strings, making them safe for inclusion in database queries and protecting against SQL injection.

Web Application Attacks & Post-Exploitation

Question

You run the following PHP script:

<?php $name = mysql_real_escape_string($_POST["name"]); $password = mysql_real_escape_string($_POST["password"]); ?> What is the use of the mysql_real_escape_string() function in the above script. Each correct answer represents a complete solution. Choose all that apply.

Options

  • AIt can be used to mitigate a cross site scripting attack.
  • BIt can be used as a countermeasure against a SQL injection attack.
  • CIt escapes all special characters from strings $_POST["name"] and $_POST["password"]
  • DIt escapes all special characters from strings $_POST["name"] and $_POST["password"].

How the community answered

(22 responses)
  • A
    14% (3)
  • B
    82% (18)
  • C
    5% (1)

Why each option

The mysql_real_escape_string() function escapes SQL-special characters in user input strings, making them safe for inclusion in database queries and protecting against SQL injection.

AIt can be used to mitigate a cross site scripting attack.

mysql_real_escape_string() only prepares strings for safe SQL usage by escaping database-special characters; it does not encode HTML entities or sanitize output for browser rendering, so it provides no protection against XSS attacks.

BIt can be used as a countermeasure against a SQL injection attack.Correct

mysql_real_escape_string() is a direct countermeasure against SQL injection because it escapes characters such as single quotes, double quotes, backslashes, and null bytes that attackers use to break out of string literals and inject arbitrary SQL commands.

CIt escapes all special characters from strings $_POST["name"] and $_POST["password"]

Choice C is textually identical to D except for the absence of a terminal period; in the source exam, D is the credited choice, and C - despite matching content - is not counted as a correct answer, reflecting a flaw in the question's construction rather than a meaningful technical distinction.

DIt escapes all special characters from strings $_POST["name"] and $_POST["password"].Correct

The function processes both $_POST['name'] and $_POST['password'] by escaping all SQL-special characters within those strings before they are used in a query, which is exactly what the function is documented to do.

Concept tested: SQL injection prevention with mysql_real_escape_string

Source: https://www.php.net/manual/en/function.mysql-real-escape-string.php

Topics

#SQL injection#input sanitization#mysql_real_escape_string#PHP security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice