IPA FE Subject A sample Question 36
A question IPA Japan published in 基本情報技術者試験 科目A サンプル問題 問36, translated into English. ITPEC is based on the same exams.
Same question on ITPEC: Spr 2020 Q43 +1 more
Which of the following is a method to prevent damage caused by an SQL injection attack?
Explanation
Preventing input characters from being interpreted as special characters in database queries — that is what stops SQL injection.
SQL injection embeds SQL fragments, such as a quote followed by OR 1=1, in form input that the application pastes into a query. If the quote is treated as a string delimiter, the attacker rewrites the query and can read or change data. Escaping such characters, or better, using placeholders (prepared statements) so input is always bound as data, keeps it from changing the query's meaning.
Answer (a)
Why not others:
- •(b) — rejecting ../ in input blocks directory traversal, which reaches files outside the intended folder
- •(c) — a length limit mainly guards against buffer overflow; a short injection string still passes
- •(d) — neutralising HTML tags in input is a countermeasure against cross-site scripting
Key rule: Match each input check to its attack: SQL special characters for SQL injection, ../ for directory traversal, HTML tags for XSS, length for buffer overflow.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.