6-Mitigations

Question 1

What is the most effective method to prevent SQL injection attacks?
A) Using regular expressions to validate input
B) Employing parameterized queries
C) Limiting user privileges
D) Implementing Web Application Firewalls (WAF)

Answer 1

B) Employing parameterized queries

Explanation: Using parameterized queries is considered the most effective method to prevent SQL injections because it separates SQL code from the data, preventing attackers from manipulating the SQL executed by the database.

Question 2

What role does input sanitization play in preventing SQL injections?
A) It formats the output of queries
B) It removes or escapes special characters in user inputs
C) It speeds up the processing of queries
D) It compresses the data to be stored in the database

Answer 2

B) It removes or escapes special characters in user inputs

Explanation: Input sanitization involves removing or escaping special characters that could be used in SQL injection attacks, rendering injected SQL code ineffective.

Question 3

Why is it important to limit database privileges for web application users?
A) To enhance the performance of the database
B) To reduce the storage requirements of the database
C) To prevent unauthorized data access or modifications
D) To increase the concurrency capabilities of the database

Answer 3

C) To prevent unauthorized data access or modifications

Explanation: Limiting database privileges is crucial to ensuring that even if an SQL injection occurs, the damage or potential data leakage can be minimized because the attacker cannot perform actions beyond their privileges.

Question 4

How does a Web Application Firewall (WAF) help mitigate SQL injection?
A) By encrypting all data transfers
B) By physically isolating the database server
C) By detecting and blocking malicious SQL code in HTTP requests
D) By optimizing SQL queries automatically

Answer 4

C) By detecting and blocking malicious SQL code in HTTP requests

Explanation: WAFs help prevent SQL injections by inspecting incoming HTTP requests and blocking those that contain malicious SQL, thereby protecting the application despite potential vulnerabilities in its code.

Question 5

What is the purpose of using the mysqli_real_escape_string() function in PHP?
A) To duplicate strings in the database
B) To encrypt passwords
C) To escape special characters in strings to be used in SQL queries
D) To convert all strings to lowercase

Answer 5

C) To escape special characters in strings to be used in SQL queries

Explanation: The mysqli_real_escape_string() function is used to escape potentially harmful characters in strings that will be used in SQL queries, preventing them from breaking out of data context and injecting malicious code.

Question 6

What does input validation check for in user submissions?
A) Correct syntax of SQL commands
B) Compatibility of data with database types
C) Conformance of data to expected patterns, such as email formats
D) Speed of data entry by the user

Answer 6

C) Conformance of data to expected patterns, such as email formats

Explanation: Input validation ensures that data submitted by users matches expected patterns (e.g., email addresses, phone numbers), which helps prevent SQL injection by rejecting unexpected inputs.

Question 7

What type of user account is recommended for web applications to interact with databases?
A) An account with DBA privileges
B) An account with minimum necessary privileges
C) An account with full read and write privileges
D) An account with guest access only

Answer 7

B) An account with minimum necessary privileges

Explanation: Web applications should interact with databases using accounts that have the minimum necessary privileges to perform required tasks, reducing the risk of severe exploitation through SQL injection.

Question 8

What does setting secure_file_priv to NULL in MySQL accomplish?
A) Allows files to be read from and written to any directory
B) Restricts file operations to a specific directory
C) Disables the ability to read from and write files to the filesystem
D) Encrypts all file operations

Answer 8

C) Disables the ability to read from and write files to the filesystem

Explanation: Setting secure_file_priv to NULL in MySQL disables the ability to use SQL commands to read from or write files to the server’s filesystem, enhancing security by limiting SQL injection impacts.

Question 9

How does parameterized querying prevent SQL injection?
A) By executing SQL commands faster
B) By checking user credentials before executing queries
C) By separating SQL logic from data inputs
D) By compressing the query data

Answer 9

C) By separating SQL logic from data inputs

Explanation: Parameterized queries prevent SQL injection by separating SQL code from data inputs. Placeholders are used for data, which is then safely processed by the database driver, preventing injected code execution.

Question 10

Which PHP function is used to bind variables to a prepared SQL statement?
A) mysqli_bind_param()
B) mysqli_stmt_bind_param()
C) mysqli_prepare()
D) mysqli_execute()

Answer 10

B) mysqli_stmt_bind_param()

Explanation: The mysqli_stmt_bind_param() function is used to bind variables to a prepared SQL statement, ensuring that the values are handled as data and not executable code, which is crucial for preventing SQL injection.