CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
An e-commerce application displays a product search results page by appending the search term to a SQL query: SELECT * FROM products WHERE name LIKE '%{term}%'. An attacker submits '%'; DROP TABLE products;--'. What type of injection is this and what is the immediate fix?
- A.Command injection; fix by escaping shell characters in the term, as the query string is passed to a shell wrapper
- B.Cross-site scripting; fix by encoding the term, since it is reflected in the results page
- C.LDAP injection; fix by escaping the filter, as the wildcard characters reach the directory server
- D.SQL injection; fix by using parameterized queries or prepared statements that treat user input as data, not executable SQL
Why D is correct
SQL injection occurs when user input is concatenated directly into SQL without parameterization. The attacker's input contains SQL syntax that the database interprets as commands, allowing data destruction. Parameterized queries (PreparedStatement in Java, PDO in PHP, $ placeholders in PostgreSQL) pass user input as data parameters that are never interpreted as SQL code.
Know someone studying for Web App Fundamentals? Send them this one.