nerdexam
GIAC

GPEN · Question #106

Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.

The correct answer is A. mysql_real_escape_string() B. Prepared statement. SQL injection is mitigated by properly escaping user input or using parameterized queries, both of which prevent malicious SQL from being interpreted by the database engine.

Web Application Penetration Testing

Question

Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.

Options

  • Amysql_real_escape_string()
  • BPrepared statement
  • Cmysql_escape_string()
  • Dsession_regenerate_id()

How the community answered

(34 responses)
  • A
    82% (28)
  • C
    6% (2)
  • D
    12% (4)

Why each option

SQL injection is mitigated by properly escaping user input or using parameterized queries, both of which prevent malicious SQL from being interpreted by the database engine.

Amysql_real_escape_string()Correct

mysql_real_escape_string() escapes special characters such as quotes and backslashes in user-supplied strings before embedding them in SQL queries, preventing injected SQL syntax from being parsed.

BPrepared statementCorrect

Prepared statements (parameterized queries) separate SQL code from data entirely, sending the query structure first and user input as bound parameters, so the database engine never interprets input as SQL commands.

Cmysql_escape_string()

mysql_escape_string() is deprecated and does not account for the connection's character set, making it vulnerable to multi-byte character encoding bypasses that mysql_real_escape_string() addresses.

Dsession_regenerate_id()

session_regenerate_id() defends against session fixation attacks by issuing a new session ID after authentication, and has no effect on SQL injection vulnerabilities.

Concept tested: SQL injection prevention using escaping and parameterized queries

Source: https://owasp.org/www-community/attacks/SQL_Injection_Prevention_Cheat_Sheet

Topics

#SQL injection#input sanitization#prepared statements#web security

Community Discussion

No community discussion yet for this question.

Full GPEN Practice