A development team is rewriting a legacy PHP application that concatenates user input directly into SQL queries. The team wants to eliminate SQL injection vulnerabilities while minimizing code changes. Which mitigation should the team implement?

Add a web application firewall (WAF) in front of the application

Disable error messages to hide database errors

Escape all user input with a generic escaping function

Use prepared statements with parameterized queries for all database access

Which of the following is a common initial test to detect a SQL injection vulnerability in an input field?

Entering a single quote (') and observing if the application returns an error or behaves unexpectedly

Entering a long string of alphanumeric characters to test input length limits

Entering HTML tags like to see if they are rendered

Entering a valid SQL query like SELECT * FROM users to see if it executes

A web application uses a WAF that blocks requests containing the string 'UNION SELECT' in any case. The tester wants to perform a UNION-based injection. Which technique is most likely to bypass the WAF?

Use double URL encoding: %2555NION

Use a different SQL keyword like 'UNION ALL'

Use inline comments: UN/**/ION SEL/**/ECT

Use URL encoding: %55NION%20SELECT

A QA engineer is testing a legacy web application that displays product details based on an 'id' parameter in the URL. When the engineer submits a single quote (') in the parameter, the application returns a detailed database error message that includes the full SQL query. The engineer wants to enumerate the database schema. Which technique should the engineer use first to leverage the verbose error output?

Use an ORDER BY clause to determine the number of columns in the original query

Submit a UNION SELECT payload to combine results with the original query

Send a boolean-based payload and compare response times

Inject a payload that triggers a syntax error revealing table and column names

A development team is migrating a legacy application to a modern framework. The application currently uses dynamic SQL strings and has a database account with sysadmin privileges. The team wants to reduce the risk of SQL injection while maintaining functionality. Which approach should the team prioritize?

Deploy a WAF and disable error messages

Use stored procedures for all database access

Implement input validation and output encoding

Rewrite all database access using parameterized queries and reduce the database account's privileges

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 1

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 7)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

9concepts

Questions 31–35

31application · medium
A development team is rewriting a legacy PHP application that concatenates user input directly into SQL queries. The team wants to eliminate SQL injection vulnerabilities while minimizing code changes. Which mitigation should the team implement?
Select an answer first
32foundation · easy
Which of the following is a common initial test to detect a SQL injection vulnerability in an input field?
Select an answer first
33application · medium
A web application uses a WAF that blocks requests containing the string 'UNION SELECT' in any case. The tester wants to perform a UNION-based injection. Which technique is most likely to bypass the WAF?
Select an answer first
34application · medium
A QA engineer is testing a legacy web application that displays product details based on an 'id' parameter in the URL. When the engineer submits a single quote (') in the parameter, the application returns a detailed database error message that includes the full SQL query. The engineer wants to enumerate the database schema. Which technique should the engineer use first to leverage the verbose error output?
Select an answer first
35expert · hard
A development team is migrating a legacy application to a modern framework. The application currently uses dynamic SQL strings and has a database account with sysadmin privileges. The team wants to reduce the risk of SQL injection while maintaining functionality. Which approach should the team prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Advanced SQL Injection (SQLi) WAHS Practice Questions (Page 7)

Questions 31–35

A development team is rewriting a legacy PHP application that concatenates user input directly into SQL queries. The team wants to eliminate SQL injection vulnerabilities while minimizing code changes. Which mitigation should the team implement?

Which of the following is a common initial test to detect a SQL injection vulnerability in an input field?

A web application uses a WAF that blocks requests containing the string 'UNION SELECT' in any case. The tester wants to perform a UNION-based injection. Which technique is most likely to bypass the WAF?

Keep studying — Injection Attacks