While performing a code audit, you discover a SQL injection vulnerability assuming the following vulnerable query, what user input could be injected to make the query true and return data? select *…

The correct answer is D. `or l=1'. The vulnerable query is: SELECT * FROM widgets WHERE name = '[user-input]'. The textbook payload to make it always return true is option C: 'or 1=1-- - the leading apostrophe closes the opening string literal, 'OR 1=1' is a tautology that always evaluates to true causing all…

Web Application Penetration Testing

Question

While performing a code audit, you discover a SQL injection vulnerability assuming the following vulnerable query, what user input could be injected to make the query true and return data? select * from widgets where name = '[user-input]';

Options

A'or 1=1
B`or l=l...
C'or 1=1--
D`or l=1'

How the community answered

(33 responses)

A
9% (3)
B
3% (1)
C
18% (6)
D
70% (23)

Explanation

The vulnerable query is: SELECT * FROM widgets WHERE name = '[user-input]'. The textbook payload to make it always return true is option C: 'or 1=1-- - the leading apostrophe closes the opening string literal, 'OR 1=1' is a tautology that always evaluates to true causing all rows to be returned, and '--' is the SQL line-comment delimiter that neutralizes the trailing quote in the original query. Option D uses a backtick character (a MySQL identifier delimiter, not a string delimiter) and lowercase 'l' rather than the digit '1', both of which would produce a syntax error rather than a valid injection. The answer key marks D as correct, but C is the classically correct, well-formed SQL injection payload for this query structure.

Topics

#SQL injection#authentication bypass#input validation#query manipulation

Community Discussion

No community discussion yet for this question.

Full GPEN Practice