SQL Injection CEH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium · select all that apply

   A development team is hardening a web application against SQL injection. Which of the following are effective prevention measures? (Select all that apply.)

   • AUse stored procedures with dynamic SQL built from user input.
   • BApply the principle of least privilege to database accounts used by the application.
   • CImplement strict input validation using an allowlist of allowed characters.
   • DUse parameterized queries or prepared statements for all database operations.
   • EEscape all user input by doubling single quotes before sending it to the database.
   Check answers Discussion Select an answer first
2. 2expert · hard

   A development team is migrating a legacy PHP application to a modern framework. The application currently uses mysql_query() with concatenated strings. The team wants to prevent SQL injection while preserving the ability to perform complex dynamic queries. Which approach should they adopt?

   • AUse an ORM like Doctrine with raw SQL queries that use quoted identifiers.
   • BUse a stored procedure that accepts user input as parameters.
   • CUse PDO prepared statements with named placeholders for all database interactions.
   • DUse mysqli_real_escape_string() on all user inputs before concatenation.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration tester is using sqlmap to exploit a SQL injection in a POST parameter. The application requires a valid session cookie and a CSRF token for each request. The tester has obtained a valid session and the CSRF token is embedded in the page. Which sqlmap option should the tester use to handle the CSRF token automatically?

   • A--data=<postdata>
   • B--level=5
   • C--cookie=<session>
   • D--csrf-token=<name>
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In addition to using parameterized queries, which coding practice helps reduce the risk of SQL injection?

   • AUsing dynamic SQL with string concatenation for flexibility.
   • BStoring all database credentials in the application source code.
   • CValidating and sanitizing all user input against an allowlist of expected values.
   • DUsing an ORM (Object-Relational Mapping) framework without any additional configuration.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration tester has found a SQL injection in a login form. The application uses a query: SELECT * FROM users WHERE username = '$user' AND password = '$pass'. The tester wants to bypass authentication and log in as the administrator. The application has a filter that removes the word 'OR' from input. Which payload should the tester use?

   • A' AND 1=1 --
   • Badmin' --
   • C' || '1'='1' --
   • D' UNION SELECT * FROM users --
   Reveal Solution Discussion Select an answer first