ITPEC FE Morning October 2019 Question 46

Source exam: ITPEC FE Morning October 2019Topic: Security

ITPEC FE Morning October 2019 — Question 46 of 80

SQL Injection Prevention — escaping special characters in database queries.

SQL injection exploits user input that gets interpreted as SQL commands. The key prevention method is escaping (or sanitizing) characters that have special meaning in SQL queries — such as ', ;, --.

  • •(d) Preventing input characters from being interpreted as special SQL characters → this is escaping/parameterization — the correct countermeasure against SQL injection
  • •(a) Replacing HTML tags → protects against XSS, not SQL injection
  • •(b) Rejecting input exceeding length limits → general input validation, not specific to SQL injection
  • •(c) Rejecting ../ in input → protects against directory traversal, not SQL injection

Key rule: SQL injection prevention = escape/sanitize special SQL characters or use prepared statements (parameterized queries).

AI-generated — may contain errors

The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.