What is SQL Injection?
A
A method of optimizing SQL queries
B
A technique to inject CSS styles into SQL
C
A security vulnerability that allows attackers to interfere with SQL queries
D
A way to increase database performance
Analysis & Theory
SQL Injection is a code injection technique that can allow attackers to access or manipulate databases improperly.
Which of the following is an example of a potential SQL injection string?
Analysis & Theory
Adding `' --` ends the current query and comments out the rest, which can be used to bypass authentication.
Which SQL command is commonly used by attackers in injection attempts?
Analysis & Theory
Attackers often try to use `DROP TABLE` or similar commands to destroy or access data.
Which of these is a secure way to prevent SQL Injection?
A
Concatenating strings in SQL queries
B
Using parameterized queries or prepared statements
C
Storing passwords in plain text
Analysis & Theory
Parameterized queries ensure that user input is treated as data, not executable code.
Which programming practice increases the risk of SQL injection?
A
Using prepared statements
C
Dynamic SQL string concatenation
Analysis & Theory
Building SQL queries by concatenating untrusted input directly can make them vulnerable.
What is the goal of a 'union-based' SQL injection?
A
Combine rows in the database
B
Steal data by appending results from another query
C
Insert data into a table
D
Improve query performance
Analysis & Theory
Union-based SQL injection retrieves data by appending a SELECT using the UNION keyword.
What does this payload attempt to do: `' OR '1'='1`?
B
End the SQL query properly
C
Bypass authentication by always returning true
Analysis & Theory
The condition `'1'='1'` is always true and can be used to bypass login checks.
How does input sanitization help prevent SQL injection?
B
It limits query performance
C
It escapes or blocks harmful characters in input
D
It changes query structure
Analysis & Theory
Sanitizing inputs ensures that harmful SQL characters are filtered out or escaped.
Which type of web application is most vulnerable to SQL injection?
A
Applications that use prepared statements
B
Applications that use ORM frameworks
C
Applications that use dynamic SQL without input validation
D
Applications without a database
Analysis & Theory
Dynamic SQL with unvalidated input is highly vulnerable to injection attacks.
How can a Web Application Firewall (WAF) help against SQL injection?
A
It encrypts the database
B
It blocks known attack patterns and malicious inputs
C
It replaces the SQL engine
D
It improves site design
Analysis & Theory
A WAF filters and blocks suspicious traffic and known SQL injection patterns.