Input Validation for Web Forms CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A developer is implementing error handling for a login form. When a user enters invalid credentials, the application should display a generic error message. Which approach is the most secure?

   • ADisplay 'Invalid username or password' for both unknown username and incorrect password, and log detailed errors to a server-side log.
   • BDisplay 'Username not found' when the username does not exist, and 'Incorrect password' when the password is wrong.
   • CDisplay the exception message returned by the database to help the user understand the issue.
   • DRedirect the user to a custom error page that shows the stack trace for transparency.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer is writing a search feature that takes a user-supplied keyword and uses it in a SQL query. The developer wants to prevent SQL injection. Which approach is the most secure?

   • AUse parameterized queries with SqlCommand and SqlParameter objects.
   • BUse a blacklist to remove keywords like SELECT, INSERT, and DROP from the input.
   • CEscape single quotes in the input before concatenating it into the SQL string.
   • DValidate the input with a RegularExpressionValidator that only allows letters and spaces.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A developer is building a page that displays user-generated content in a rich text editor. The content is stored as HTML. The developer wants to prevent XSS while allowing basic formatting like bold and italics. Which approach is the most effective?

   • AEncode the entire content with HttpUtility.HtmlEncode before storing it.
   • BUse an HTML sanitizer library that whitelists allowed tags and attributes, and encode the output when rendering.
   • CAllow any HTML but remove <script> tags using a blacklist.
   • DUse a RegularExpressionValidator to ensure the content only contains letters and spaces.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An ASP.NET application allows users to upload profile pictures. The developer needs to ensure that only valid image files are uploaded. Which combination of checks is the most effective?

   • ACheck only the MIME type reported by the browser.
   • BCheck the file extension against a whitelist, verify the MIME type, and validate the file content by reading the image header.
   • CStore the file in a database as a BLOB and rely on the database to reject invalid files.
   • DCheck only the file extension to ensure it is .jpg or .png.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a common input validation vulnerability that occurs when user input is included in a database query without proper handling?

   • ABroken authentication
   • BSQL injection
   • CCross-site request forgery (CSRF)
   • DSecurity misconfiguration
   Reveal Solution Discussion Select an answer first