ITPEC FE Morning April 2018 Question 39

A malicious string entered into a web application's database call — SQL injection alters the SQL statement so the attacker can read, change or delete data.

If the application builds an SQL statement by pasting user input into it, input such as ' OR '1'='1 changes the meaning of the statement: a condition that should match one user's row matches every row, or an extra statement deletes data. The defence is to use prepared statements (placeholders) or to escape special characters.

Answer (c)

Why not others:

• •(a) — describes a DoS attack that floods a site with traffic, here relayed through another site, to stop its service
• •(b) — describes a buffer overflow: writing past the end of a memory area to crash the program or run injected code
• •(d) — describes cross-site scripting: a trap link makes a vulnerable site return a script that runs in the victim's browser

Key rule: Injection attacks exploit input that ends up inside code: into an SQL statement is SQL injection, into a page's HTML or script is cross-site scripting.

Security · AI-written, may contain errors