nerdexam
CompTIA

SY0-501 · Question #32

Which of the following BEST describes a routine in which semicolons, dashes, quotes, and commas are removed from a string?

The correct answer is C. Input validation to protect against SQL injection. The routine described is a form of input validation where special characters are removed from a string to prevent malicious code injection.

Submitted by tyler.j· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

Which of the following BEST describes a routine in which semicolons, dashes, quotes, and commas are removed from a string?

Options

  • AError handling to protect against program exploitation
  • BException handling to protect against XSRF attacks
  • CInput validation to protect against SQL injection
  • DPadding to protect against string buffer overflows

How the community answered

(62 responses)
  • A
    3% (2)
  • B
    6% (4)
  • C
    79% (49)
  • D
    11% (7)

Why each option

The routine described is a form of input validation where special characters are removed from a string to prevent malicious code injection.

AError handling to protect against program exploitation

Error handling deals with runtime errors and unexpected conditions, which is distinct from proactively sanitizing user input to prevent security vulnerabilities.

BException handling to protect against XSRF attacks

Exception handling manages runtime errors, while XSRF attacks are mitigated by validating the origin of requests using techniques like anti-forgery tokens, not by stripping specific characters from input.

CInput validation to protect against SQL injectionCorrect

Removing characters like semicolons, quotes, and dashes from user input is a critical input validation technique. This sanitization process prevents attackers from manipulating SQL statements by injecting malicious code or by prematurely terminating queries, thereby directly protecting against SQL injection.

DPadding to protect against string buffer overflows

Padding involves adding characters to a string to meet a specific length, which is unrelated to removing characters for sanitization or preventing string buffer overflows, which are typically addressed by bounds checking.

Concept tested: Input validation for SQL injection prevention

Source: https://learn.microsoft.com/en-us/dotnet/standard/security/sql-injection-prevention

Topics

#input validation#SQL injection#sanitization#application security

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice