AP Cybersecurity Drill 21: Web Form and the Inventory Database

Question 1. When the logged value is inserted into the query, what condition does the database actually evaluate in the WHERE clause?

• A) name equals rose, OR the always-true comparison '1'='1', so every product row in the table matches ✓
• B) name equals the whole literal text rose' OR '1'='1 as one search term, so no product row matches at all
• C) name equals rose only, because the database is built to ignore any extra text that follows a space
• D) name equals rose and price is null, so the query returns only products that have no listed price

Explanation: Choice A is correct. The single quote after rose closes the string, OR begins a second condition, and '1'='1' is always true; because the WHERE clause is now name='rose' OR true, every row satisfies it. Choice B is incorrect because the quote is treated as code, not as part of a literal value, so the input is not matched character-for-character. Choice C is incorrect because the database does not stop reading at a space; it parses the full string as SQL. Choice D is incorrect because nothing in the input refers to price or null; that condition is invented.

Question 2. What class of attack does this input represent?

• A) Cross-site scripting, which injects script that later runs inside another visitor's web browser session
• B) SQL injection, which inserts crafted input that the database parses and runs as part of its query ✓
• C) Directory traversal, which uses path sequences to reach files stored outside the web root folder on disk
• D) Buffer overflow, which writes past the end of a fixed memory buffer to overwrite adjacent program data

Explanation: Choice B is correct. Untrusted input is placed inside an SQL statement and executed as code, which is the definition of SQL injection. Choice A is incorrect because cross-site scripting targets a browser with injected script, not the database query. Choice C is incorrect because directory traversal manipulates file paths to escape a folder, which is not what this input does. Choice D is incorrect because a buffer overflow overruns a memory buffer; this attack abuses query syntax, not memory.

Question 3. A second entry typed into the search box is: x'; DROP TABLE products; -- (with a trailing space). Which clue in this entry most strongly signals an attempted injection rather than a normal search?

• A) It contains the word products, which also happens to name a real table the store keeps in its database
• B) It is somewhat longer than the typical one-word product name a casual shopper would reasonably type in
• C) It uses an apostrophe, and shoppers do occasionally include apostrophes in legitimate product names they search
• D) It chains a quote, a semicolon to end one statement, a DROP TABLE command, and -- to comment out the rest ✓

Explanation: Choice D is correct. The combination of a closing quote, a statement-ending semicolon, a destructive DROP TABLE command, and a comment marker to neutralize the trailing code is SQL syntax, not search text, and is the clearest tell. Choice A is incorrect because a search naturally can mention products; the word alone is not suspicious. Choice B is incorrect because length by itself is weak evidence; long legitimate searches exist. Choice C is incorrect because an apostrophe alone is common in real names and is not conclusive on its own.

Question 4. Why does building the query by joining text create the risk, regardless of what the visitor types?

• A) Because joining text makes the query string longer, and longer queries take more time for the database to run
• B) Because the visitor's characters become part of the command itself, so input can change what the query does ✓
• C) Because the database caches joined queries, so an old result is returned instead of fresh product data
• D) Because joined text is stored in plaintext, which lets anyone reading the log recover the product prices

Explanation: Choice B is correct. When input is concatenated into the statement, the data and the code share the same string, so characters the visitor supplies can be read as SQL and alter the query's meaning. Choice A is incorrect because query length and run time are not the security problem. Choice C is incorrect because caching old results is not how this risk arises. Choice D is incorrect because plaintext logging of prices is unrelated to why concatenation is dangerous.

Question 5. Which change best removes the vulnerability at its source?

• A) Use a parameterized query so the database treats the supplied input as a data value, not as command text ✓
• B) Hide the search box from the page menu so only customers who already know the direct link can reach the form
• C) Lower the database account's password strength so the busy support team can rotate it far more often
• D) Truncate every search to ten characters so that a longer malicious string simply cannot fit in the input field

Explanation: Choice A is correct. Parameterized queries (prepared statements) send user input strictly as data bound to a placeholder, so it is never interpreted as SQL; this fixes the root cause. Choice B is incorrect because hiding the form is obscurity, not a fix; the endpoint still accepts the same input. Choice C is incorrect because weakening the password reduces security and does nothing about injection. Choice D is incorrect because a length cap is brittle and does not separate data from command text; attackers can often craft shorter payloads, and truncation tends to create errors rather than safety.