ITPEC FE Subject A April 2026 Question 34

It selects every record in the accounts table and then deletes the table.

Read the injected statement in two parts: SELECT * FROM accounts WHERE username='1' or '1'='1'; DROP TABLE accounts;

• •'1'='1' is always true, and or makes the whole WHERE clause true for every row — the username test no longer filters anything
• •the ; ends that statement, and the appended DROP TABLE accounts removes the table from the database entirely

Answer (c)

Why not others:
- (a) — nothing here inserts or creates a user; there is no INSERT or CREATE
- (b) — a pop-up box is the signature of cross-site scripting, which injects JavaScript into a page, not SQL into a query
- (d) — DROP TABLE destroys the whole table including its definition; it does not delete selected rows, which would need DELETE

Key rule: The two halves of a classic injection are the always-true condition that defeats the filter and the statement separator that appends a second command. Parameterised queries stop both.

AI-generated — may contain errors