GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ831

Exploiting Insecure Web Application References

Which of the following can be used as countermeasures against an SQL injection attack?

Each correct answer represents a complete solution.

Choose two
  • A mysql_real_escape_string()
  • B session_regenerate_id()
  • C mysql_escape_string()
  • D Prepared statement
Explanation

Prepared statements bind user input as data rather than executable SQL syntax. mysql_real_escape_string() escapes SQL-special characters according to the active MySQL connection character set when used correctly, preventing injected input from altering a query’s structure.

Community Discussion

No comments yet. Be the first to start the discussion!