Which of the following is the BEST indicator of a SQL injection vulnerability?

Question

Options

• AApplication crashes after invalid input
• BError messages revealing database syntax
• CSlow page loads
• DMissing HTTP security headers

• A
  3% (1)
• B
  73% (24)
• C
  9% (3)
• D
  15% (5)

Explanation

Error messages revealing database syntax (B) are the strongest indicator of SQL injection vulnerability because they confirm the application is passing unvalidated input directly to the database engine - and the database is responding with structural feedback. When you see errors like ORA-00933: SQL command not properly ended or Unclosed quotation mark after the character string, the database itself is telling you it received malformed SQL, which means an attacker can probe and manipulate queries.

Why the distractors are wrong:

• A (Application crashes): Crashes can stem from countless causes - null pointer errors, memory issues, malformed JSON - none of which imply SQL injection specifically.
• C (Slow page loads): Performance issues point to network latency, unoptimized queries, or server load, not injection vulnerabilities. (Time-based blind SQLi can cause delays, but slow loads alone are not an indicator.)
• D (Missing HTTP security headers): Headers like Content-Security-Policy relate to XSS and clickjacking, not SQL injection.

Memory tip: Think "database talks back." SQL injection is confirmed when the database engine's own error messages leak into the application response - the database is essentially revealing that it received and tried to parse your injected input as a real query. If you see database syntax in an error, the application forgot to sanitize.

No community discussion yet for this question.