ITPEC FE Morning April 2020 Question 43

Preventing input characters from being interpreted as special characters in database queries — that is what stops SQL injection.

SQL injection embeds SQL fragments, such as a quote followed by OR 1=1, in form input that the application pastes into a query. If the quote is treated as a string delimiter, the attacker rewrites the query and can read or change data. Escaping such characters, or better, using placeholders (prepared statements) so input is always bound as data, keeps it from changing the query's meaning.

Answer (a)

Why not others:

• •(b) — rejecting ../ in input blocks directory traversal, which reaches files outside the intended folder
• •(c) — a length limit mainly guards against buffer overflow; a short injection string still passes
• •(d) — neutralising HTML tags in input is a countermeasure against cross-site scripting

Key rule: Match each input check to its attack: SQL special characters for SQL injection, ../ for directory traversal, HTML tags for XSS, length for buffer overflow.

Security · AI-written, may contain errors