ITPEC FE Morning April 2020 Question 43
ITPEC FE Morning April 2020 — Question 43 of 80
SQL Injection Prevention — escaping special characters in user input.
Preventing input characters from being interpreted as SQL control characters (quotes, semicolons, etc.) stops injected SQL from executing.
This is achieved through input sanitization or parameterized queries (prepared statements).
Why not others:
- (b) — protects against directory traversal, not SQL injection
- (c) — length limits don't prevent short payloads like ' OR 1=1--
- (d) — HTML tag escaping protects against XSS, not SQL injection
Key rule: SQL injection prevention = escape/sanitize SQL special characters or use parameterized queries.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.