Injection Part 2

The SQL keyword to only display rows matching a specified condition is...

• FILTER

• MATCH

• WHERE

• SORT

SELECT name FROM users ORDER BY age DESC LIMIT 1;

• shows the names of all users in age order

• shows the names of all users in reverse age order

• shows only the age of the youngest user

• shows only the name of the oldest user

The SQL keyword used to combine the results of two SELECT statements is...

• COMBINE

• JOIN

• UNION

• CONCAT

SELECT SUBSTRING('HARIBO', 3, 1);

• returns "HAR"

• returns "HARI"

• returns "H"

• returns "R"

The SQL keyword to order records by the column(s) specified is...

• ORDER BY

• SEQUENCE BY

• SORT BY

• UNION

SELECT username FROM users WHERE password = '' OR 1=1;

• returns all usernames that have a blank password

• returns all usernames from the users table

• returns all rows and columns from the users table

• returns all passwords from the users table

Which is not correct SQL syntax to specify a comment?

• #

• <comment></comment>

• --

• /* */

SELECT password FROM users WHERE id IS NULL AND 1=2;

• returns all passwords

• returns all ids

• returns all records from the users table

• returns nothing

Look at the example below. By default, sqlmap connects to the target database with what privileges?

• same as the session user

• same as the target application

• root

• same as the database owner

A sqlmap scan reports that none of the tested parameters appear to be injectable, therefore...

• SQL injection is not possible

• injection attacks in general are not possible

• SQL injection may still be possible

• None of the above