ITPEC FE Subject B April 2026 Question 19
ITPEC FE Subject B April 2026 — Question 19 of 20
A is Success and B is Fail — both inputs comment out the password check, but the second injects a condition that can never hold.
Substitute each value into the template.
With admin' -- the statement becomes WHERE username = 'admin' --' AND password = '...'. Everything after -- is a comment, so the password comparison disappears and only the username is tested. The preregistered admin row matches, so authentication is bypassed — Success.
With admin' AND '1'='2' -- the password comparison is commented out in exactly the same way, but '1'='2' sits before the comment marker and is therefore evaluated. It is always false, so no row matches — Fail.
Answer (c)
Why not others:
- (a) — marks the first input as a failure, yet once the password comparison is commented away nothing remains that could reject a valid username
- (d) — marks the second as a success, ignoring that the injected always-false condition is still part of the live WHERE clause
- (b) — inverts both results
Key rule: A comment marker removes only what follows it. Whatever the attacker injects ahead of it still executes, which is why an always-true condition guarantees the bypass and an always-false one defeats it.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.