GPEN · Question #174
Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.
The correct answer is C. mysql_real_escape_string() D. Prepared statement. SQL injection is mitigated by properly escaping user input and using parameterized queries; mysql_real_escape_string() and prepared statements are the two accepted countermeasures here.
Question
Which of the following can be used as a countermeasure against the SQL injection attack? Each correct answer represents a complete solution. Choose two.
Options
- Amysql_escape_string()
- Bsession_regenerate_id()
- Cmysql_real_escape_string()
- DPrepared statement
How the community answered
(44 responses)- A7% (3)
- B9% (4)
- C84% (37)
Why each option
SQL injection is mitigated by properly escaping user input and using parameterized queries; mysql_real_escape_string() and prepared statements are the two accepted countermeasures here.
mysql_escape_string() does not account for the database connection's character set, making it vulnerable to multi-byte character encoding attacks that can bypass escaping, so it is not a reliable countermeasure.
session_regenerate_id() is a session-fixation countermeasure that generates a new session ID after authentication; it has no effect on SQL injection vulnerabilities.
mysql_real_escape_string() escapes special characters in a string using the current character set of the database connection, preventing injected SQL metacharacters from being interpreted as query syntax.
Prepared statements (parameterized queries) separate SQL code from data by sending the query structure first and the user-supplied values separately, so the database engine never treats input data as executable SQL.
Concept tested: SQL injection prevention techniques in web applications
Source: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
Topics
Community Discussion
No community discussion yet for this question.