Suppose a web application builds the SQL command "select PhoneNumber from contacts where Company = '[value]';". What would the result likely be if an attacker submitted the value "GIAC'; drop table…

Question

Options

• ANothing. The 'contacts;--' portion is syntactically incorrect.
• BThe database would attempt to drop the PhoneNumber from the 'GIAC' table.
• CThe 'contacts' table would be deleted from the database.
• DThe database would drop all records containing 'GIAC' from the 'contacts' table.

• A
  5% (3)
• B
  3% (2)
• C
  83% (48)
• D
  9% (5)

Explanation

The SQL command being built is: SELECT PhoneNumber FROM contacts WHERE Company = '[value]'; If the attacker inputs: GIAC'; DROP TABLE contacts; -- The resulting SQL statement becomes: SELECT PhoneNumber FROM contacts WHERE Company = 'GIAC'; DROP TABLE contacts; --'; The first part executes a valid SELECT query. Then, the semicolon ; terminates the SELECT. The second part DROP TABLE contacts; is executed as a new command. The -- is a SQL comment, which comments out the rest of the line, avoiding syntax errors. As a result, the entire contacts table would be deleted if the application allows multiple SQL statements and lacks proper sanitization.

No community discussion yet for this question.