GPEN · Question #106
Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.
The correct answer is A. mysql_real_escape_string() B. Prepared statement. SQL injection is mitigated by properly escaping user input or using parameterized queries, both of which prevent malicious SQL from being interpreted by the database engine.
Question
Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.
Options
- Amysql_real_escape_string()
- BPrepared statement
- Cmysql_escape_string()
- Dsession_regenerate_id()
How the community answered
(34 responses)- A82% (28)
- C6% (2)
- D12% (4)
Why each option
SQL injection is mitigated by properly escaping user input or using parameterized queries, both of which prevent malicious SQL from being interpreted by the database engine.
mysql_real_escape_string() escapes special characters such as quotes and backslashes in user-supplied strings before embedding them in SQL queries, preventing injected SQL syntax from being parsed.
Prepared statements (parameterized queries) separate SQL code from data entirely, sending the query structure first and user input as bound parameters, so the database engine never interprets input as SQL commands.
mysql_escape_string() is deprecated and does not account for the connection's character set, making it vulnerable to multi-byte character encoding bypasses that mysql_real_escape_string() addresses.
session_regenerate_id() defends against session fixation attacks by issuing a new session ID after authentication, and has no effect on SQL injection vulnerabilities.
Concept tested: SQL injection prevention using escaping and parameterized queries
Source: https://owasp.org/www-community/attacks/SQL_Injection_Prevention_Cheat_Sheet
Topics
Community Discussion
No community discussion yet for this question.