nerdexam
GIAC

GPEN · Question #74

You run the following PHP script: <?php $name = mysql_real_escape_string($_POST["name"]); $password = mysql_real_escape_string($_POST["password"]);?> What is the use of the mysql_real_escape_string()

The correct answer is A. It escapes all special characters from strings $_POST["name"] and $_POST["password"]. D. It can be used as a countermeasure against a SQL injection attack.. mysql_real_escape_string() escapes special characters in user input to sanitize SQL queries and prevent SQL injection attacks.

Web Application Penetration Testing

Question

You run the following PHP script:

<?php $name = mysql_real_escape_string($_POST["name"]); $password = mysql_real_escape_string($_POST["password"]);?> What is the use of the mysql_real_escape_string() function in the above script. Each correct answer represents a complete solution. Choose all that apply

Options

  • AIt escapes all special characters from strings $_POST["name"] and $_POST["password"].
  • BIt escapes all special characters from strings $_POST["name"] and $_POST["password"]
  • CIt can be used to mitigate a cross site scripting attack.
  • DIt can be used as a countermeasure against a SQL injection attack.

How the community answered

(53 responses)
  • A
    79% (42)
  • B
    15% (8)
  • C
    6% (3)

Why each option

mysql_real_escape_string() escapes special characters in user input to sanitize SQL queries and prevent SQL injection attacks.

AIt escapes all special characters from strings $_POST["name"] and $_POST["password"].Correct

mysql_real_escape_string() processes the input strings and escapes characters such as quotes, backslashes, and null bytes that could otherwise alter the structure of an SQL query, making A a complete and accurate description of its behavior.

BIt escapes all special characters from strings $_POST["name"] and $_POST["password"]

This choice is functionally identical to choice A - differing only in a missing trailing period - and is therefore a redundant distractor; only one of the two duplicate statements is accepted as the correct answer.

CIt can be used to mitigate a cross site scripting attack.

mysql_real_escape_string() only escapes characters for SQL context and does not encode HTML entities or JavaScript constructs, so it provides no protection against cross-site scripting (XSS) attacks.

DIt can be used as a countermeasure against a SQL injection attack.Correct

By escaping special characters before embedding user input into SQL statements, mysql_real_escape_string() neutralizes SQL injection payloads, serving as a direct countermeasure against this class of attack.

Concept tested: PHP SQL injection prevention with input sanitization

Source: https://www.php.net/manual/en/function.mysql-real-escape-string.php

Topics

#SQL injection#input sanitization#mysql_real_escape_string#PHP security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice