ITPEC FE Morning October 2021 Question 43

SQL Injection — DROP TABLE via tautology — identify the effect of a compound injected SQL statement.

The injected SQL contains two statements separated by ;:

• •SELECT * FROM accounts WHERE username='1' or '1'='1' — the condition '1'='1' is always true, so all rows are returned
• •DROP TABLE accounts — deletes the entire table from the database

Why not others:
- (a) — no INSERT or CREATE statement exists
- (b) — pop-up boxes are an XSS concept, not SQL behavior
- (d) — DROP TABLE removes the whole table, not just "the rest of the records"

Key rule: SQL injection with ; allows chaining multiple statements. '1'='1' is a classic tautology that bypasses WHERE filters. Defense: use prepared statements (parameterized queries).

AI-generated — may contain errors