ITPEC FE Subject A April 2026 Question 34

Topic: SecurityAlso asked in November 2021

An SQL injection attack caused the SQL statement below to be executed. Which of the following does the SQL statement do? Here, the accounts table contains user account information in each row.

SELECT * FROM accounts WHERE username='1' or '1'='1'; DROP TABLE accounts;

Explanation

It selects every record in accounts and then deletes the accounts table — the injected text makes the condition always true and appends a second statement.

Read the injected statement in two parts:

  • •username='1' or '1'='1' — '1'='1' is always true, and or makes the whole WHERE clause true for every row, so the SELECT returns all records
  • •; DROP TABLE accounts; — the semicolon ends the first statement, and DROP TABLE removes the table, definition and data, from the database

Answer (c)

Why not others:

  • •(a) — nothing creates a user; that would need an INSERT or CREATE USER statement
  • •(b) — a pop-up box is what cross-site scripting produces by injecting JavaScript into a web page; SQL runs on the database and displays nothing
  • •(d) — the WHERE clause matches every row, not one, and DROP TABLE removes the whole table rather than some rows, which would need DELETE

Key rule: A classic SQL injection pairs an always-true condition that defeats the filter with a statement separator that appends a new command; placeholders (prepared statements) block both by keeping input out of the SQL text.

Security · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.