CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
An e-commerce application displays a product search results page by appending the search term to a SQL query: SELECT * FROM products WHERE name LIKE '%{term}%'. An attacker submits '%'; DROP TABLE products;--'. What type of injection is this and what is the immediate fix?
- A.NoSQL injection; fix by switching to MongoDB
- B.SQL injection; fix by using parameterized queries or prepared statements that treat user input as data, not executable SQL
- C.Command injection; fix by escaping the percent sign
- D.LDAP injection; fix by encoding the search term in Base64
Why B is correct
SQL injection occurs when user input is concatenated directly into SQL without parameterization. The attacker's input contains SQL syntax that the database interprets as commands, allowing data destruction. Parameterized queries (PreparedStatement in Java, PDO in PHP, $ placeholders in PostgreSQL) pass user input as data parameters that are never interpreted as SQL code.
Know someone studying for Web App Fundamentals? Send them this one.