ITPEC FE Morning October 2019 Question 46

Escaping input so it has no special meaning in a database query — this is what stops SQL injection.

SQL injection works when user input is pasted into an SQL statement and characters such as ', ; or -- in it change the statement itself; for example, ' OR '1'='1 turns a login check into one that is always true. The defence is to keep input as data: use prepared statements with placeholders (bind variables), or escape every character that has a special meaning in SQL.

Answer (d)

Why not others:

• •(a) — neutralising HTML tags is the countermeasure against cross-site scripting; SQL does not interpret HTML tags
• •(b) — a length limit helps against buffer overflows, but a short string such as ' OR 1=1-- still injects SQL
• •(c) — rejecting ../ blocks directory traversal, which reaches files outside the intended folder, not database queries

Key rule: Each injection attack is stopped by neutralising the characters special to its target interpreter: SQL metacharacters for SQL injection, HTML for XSS, path strings for directory traversal.

Security · AI-written, may contain errors