ITPEC FE Subject B April 2026 Question 19
From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the description.
Company R is an e-commerce company that sells smartphone accessories through its website. In response to the increasing prevalence of SQL injection attacks in recent years, Company R decided to conduct a security training program for its security analysts, focusing specifically on SQL injection vulnerabilities.
[Explanation of SQL Behavior]
As part of the training, an explanation was provided to help the security analysts understand the working mechanism of SQL statements. In typical web applications, authentication is performed by constructing an SQL statement based on a predefined template. The application inserts the user-provided username and the hashed value of the user-provided password into the template and submits the resulting SQL statement to the database to check whether a matching record exists. An example of such an SQL query template is shown in figure given below.
Figure SQL Query Template for Authentication
If user input is incorporated into an SQL statement without proper handling, the structure of the SQL query may be altered, enabling attacks such as SQL injection. For instance, SQL syntax elements included in the input may be interpreted by the database. One common element is “--”, which starts a comment; any text that follows “--” is ignored by the database engine, effectively disabling the remaining part of the SQL statement, including the password check.
[Hands-on Verification]
The security analysts participated in a hands-on lab using a dedicated training server. They submitted crafted input values through the application’s authentication form. The application processed these inputs, inserted the username and the hashed password value into the SQL template shown in the figure above, generated a complete SQL statement, and executed it against the database.
The database contained a preregistered admin user with a hashed password that was not disclosed to the participants. They tested several input values for <input_username> while leaving the password input field empty in the authentication form to determine whether authentication could be bypassed, and summarized the results in table given below.
Table Evaluation Results
Answer Group
Explanation
A: Success, B: Fail — both inputs comment out the password check, but the second adds a condition that is always false before the comment.
Substitute each input into the template.
admin' -- gives WHERE username = 'admin' --' AND password = '...'. The quote closes the username string and -- turns the rest, including the password comparison, into a comment. Only username = 'admin' remains, the preregistered admin row matches, and authentication is bypassed: Success.
admin' AND '1'='2' -- gives WHERE username = 'admin' AND '1'='2' --.... The password check is commented out the same way, but '1'='2' stands before the --, so it is still evaluated. It is always false, no row matches: Fail.
Answer (c)
Why not others:
- •(a) — marks the first input as a failure, but once the password comparison is commented out nothing is left that could reject the valid username
admin - •(b) — swaps the two results: the second input keeps an always-false condition in the live
WHEREclause - •(d) — marks the second input as a success, ignoring that
'1'='2'precedes the comment and still applies
Key rule: A comment marker removes only what follows it; whatever is injected before it still executes, so an always-true condition helps the attacker and an always-false one blocks the match.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.