IPA IP 2026 Question 95
A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問95, translated into English. ITPEC is based on the same exams.
Which of the following is the term for replacing harmful character strings contained in the content that a user entered on a website with harmless character strings so as not to cause a malfunction in processing, which is used in countermeasures against SQL injection and other such attacks?
Explanation
Sanitizing — making user input harmless before the processing that receives it can misread it.
Characters that have a special meaning to the receiving process, such as ' in an SQL statement or < and > in HTML, are replaced with harmless equivalents (escaped), so the input is treated only as data. Against SQL injection, an input such as ' OR '1'='1 can then no longer change the SQL statement; against cross-site scripting, <script> is displayed as text instead of being run.
Answer (b)
Why not others:
- •(a) MAC address filtering — lets only devices with registered MAC addresses connect, typically to a wireless LAN access point; it does not look at what users enter
- •(c) Striping — RAID 0: spreading data across several disks to speed up access
- •(d) Social engineering — obtaining passwords or confidential information by exploiting people's carelessness, for example by peeking or by phoning as someone else; an attack, not a countermeasure
Key rule: Sanitizing (escaping) user input is the standard countermeasure against injection attacks such as SQL injection and cross-site scripting.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.