1. What is SQL Injection?
🔘 A. A technique used to inject client-side scripts
🔘 B. A technique used to exploit vulnerabilities in an SQL database
🔘 C. A method to encrypt SQL queries
🔘 D. A process for securing SQL databases
✅ Answer: B
Explanation: SQL Injection is a vulnerability that allows attackers to manipulate an SQL database by injecting malicious SQL queries.
2. Which SQL statement is most commonly targeted by SQL Injection attacks?
🔘 A. INSERT
🔘 B. UPDATE
🔘 C. SELECT
🔘 D. DELETE
✅ Answer: C
Explanation: The SELECT statement is commonly targeted because it retrieves data from the database, making it a primary point of exploitation.
3. What type of SQL Injection attack exploits errors returned by the database?
🔘 A. Blind SQL Injection
🔘 B. Error-Based SQL Injection
🔘 C. Time-Based SQL Injection
🔘 D. Boolean-Based SQL Injection
✅ Answer: B
Explanation: Error-Based SQL Injection leverages detailed database error messages to extract information about the database structure.
4. What character is commonly used to terminate SQL queries in injection attacks?
🔘 A. #
🔘 B. ;
🔘 C. ' (single quote)
🔘 D. " (double quote)
✅ Answer: C
Explanation: A single quote (') is often used to break out of an SQL statement and inject malicious code.
5. Which type of SQL Injection attack does NOT return any data to the attacker?
🔘 A. Boolean-Based SQL Injection
🔘 B. Error-Based SQL Injection
🔘 C. Blind SQL Injection
🔘 D. UNION-Based SQL Injection
✅ Answer: C
Explanation: Blind SQL Injection does not return data directly but allows attackers to infer information based on the application’s response.
6. What is the best way to prevent SQL Injection attacks?
🔘 A. Using input validation only
🔘 B. Using prepared statements and parameterized queries
🔘 C. Encrypting all database queries
🔘 D. Disabling SQL commands
✅ Answer: B
Explanation: Parameterized queries and prepared statements ensure that user input is treated as data, preventing it from being executed as SQL commands.
7. What is the role of the UNION operator in SQL Injection attacks?
🔘 A. Combines legitimate and malicious queries
🔘 B. Encrypts SQL queries
🔘 C. Blocks SQL Injection attempts
🔘 D. Deletes database records
✅ Answer: A
Explanation: The UNION operator allows attackers to combine results from multiple SELECT queries, potentially exposing sensitive data.
8. How can attackers use “Boolean-Based Blind SQL Injection”?
🔘 A. By modifying queries and observing different application responses
🔘 B. By directly extracting database records
🔘 C. By corrupting database indexes
🔘 D. By disabling authentication
✅ Answer: A
Explanation: Attackers modify queries with true/false conditions and analyze the application’s behavior to infer database information.
9. What does the SQL OR 1=1 condition achieve in an SQL Injection attack?
🔘 A. Validates SQL queries
🔘 B. Ensures only valid input is executed
🔘 C. Always evaluates to TRUE, allowing unauthorized access
🔘 D. Causes the query to fail
✅ Answer: C
Explanation: The condition OR 1=1 always evaluates to TRUE, often allowing unauthorized access to database records.
10. Which of the following is an example of a parameterized SQL query?
🔘 A. SELECT * FROM users WHERE username = '$user'
🔘 B. SELECT * FROM users WHERE username = ?
🔘 C. SELECT * FROM users WHERE username = user_input()
🔘 D. SELECT * FROM users WHERE username = 'user' OR '1'='1'
✅ Answer: B
Explanation: Parameterized queries (e.g., using ? placeholders) safely separate user input from SQL execution.
11. Which database management system (DBMS) is vulnerable to SQL Injection?
🔘 A. MySQL
🔘 B. PostgreSQL
🔘 C. SQL Server
🔘 D. All of the above
✅ Answer: D
Explanation: All major DBMSs can be vulnerable if user input is not properly sanitized.
12. Which function in PHP helps prevent SQL Injection when using MySQL?
🔘 A. mysql_real_escape_string()
🔘 B. htmlspecialchars()
🔘 C. base64_encode()
🔘 D. strip_tags()
✅ Answer: A
Explanation: mysql_real_escape_string() escapes special characters to prevent SQL Injection (though prepared statements are preferred).
13. Which HTTP method is most commonly exploited in SQL Injection?
🔘 A. GET
🔘 B. POST
🔘 C. Both GET and POST
🔘 D. PUT
✅ Answer: C
Explanation: Both GET and POST requests can be used to send malicious SQL queries if input validation is weak.
14. What does a Time-Based Blind SQL Injection attack do?
🔘 A. Executes time delays in queries to infer database responses
🔘 B. Returns full database results
🔘 C. Encrypts database records
🔘 D. Uses CAPTCHA to bypass authentication
✅ Answer: A
Explanation: Attackers use time delays (SLEEP(n)) to determine whether their injected query was executed.
15. What is a Web Application Firewall (WAF) used for?
🔘 A. Detecting and blocking SQL Injection attacks
🔘 B. Encrypting database queries
🔘 C. Storing SQL logs
🔘 D. Optimizing SQL queries
✅ Answer: A
Explanation: A WAF can analyze incoming requests and block SQL Injection attempts.
16. How does stored SQL Injection differ from reflected SQL Injection?
🔘 A. Stored SQL Injection affects stored data, while reflected attacks execute immediately
🔘 B. Stored SQL Injection is harmless
🔘 C. Reflected SQL Injection only targets admin accounts
🔘 D. They are the same
✅ Answer: A
Explanation: Stored SQL Injection persists in the database, affecting multiple users, while reflected SQL Injection executes immediately.
25. Which security measure can further reduce SQL Injection risks?
🔘 A. Using Least Privilege Principle for database accounts
🔘 B. Granting full database access to all users
🔘 C. Disabling database authentication
🔘 D. Allowing all SQL queries
✅ Answer: A
Explanation: Limiting privileges ensures attackers cannot execute dangerous queries even if they exploit an injection flaw.
26. What is an advanced method to test for SQL Injection vulnerabilities?
🔘 A. Sending regular inputs to check for errors
🔘 B. Using SQL fuzzing techniques to detect blind SQL Injection
🔘 C. Running JavaScript inside SQL queries
🔘 D. Only using known SQL injection payloads
✅ Answer: B
Explanation: SQL fuzzing involves injecting various unexpected inputs to detect blind SQL vulnerabilities.
27. What is the main difference between UNION-based SQL Injection and Boolean-based SQL Injection?
🔘 A. UNION-based SQL Injection extracts data, while Boolean-based infers data
🔘 B. Boolean-based SQL Injection is more dangerous
🔘 C. UNION-based SQL Injection does not require SQL syntax knowledge
🔘 D. Boolean-based SQL Injection returns entire database tables
✅ Answer: A
Explanation: UNION-based SQLi retrieves data directly, whereas Boolean-based SQLi determines information by altering conditions and observing responses.
28. Which SQL function can be abused in an SQL Injection attack to determine the database version?
🔘 A. GETVERSION()
🔘 B. DATABASE()
🔘 C. VERSION()
🔘 D. DB_NAME()
✅ Answer: C
Explanation: The VERSION() function in MySQL and @@VERSION in SQL Server return the database version, helping attackers tailor their exploits.
29. Why is input validation alone insufficient to prevent SQL Injection?
🔘 A. Attackers can bypass weak validation rules
🔘 B. Validation can break normal functionality
🔘 C. It slows down queries
🔘 D. Input validation is only needed for passwords
✅ Answer: A
Explanation: Input validation helps but is not foolproof because attackers can find ways to bypass weak validation rules.
30. Which of the following is NOT a recommended SQL Injection prevention technique?
🔘 A. Using ORM (Object-Relational Mapping) frameworks
🔘 B. Implementing prepared statements
🔘 C. Granting full database privileges to all users
🔘 D. Escaping special characters
✅ Answer: C
Explanation: Granting full privileges increases risks. It’s best to use least privilege access principles.
31. What does a “Time-Based Blind SQL Injection” attack use to determine success?
🔘 A. Database errors
🔘 B. Boolean values
🔘 C. Time delays
🔘 D. Random database values
✅ Answer: C
Explanation: Attackers use SLEEP(), BENCHMARK(), or similar functions to delay responses, indicating whether an injected query was executed.
32. What tool is commonly used to automate SQL Injection attacks?
🔘 A. Wireshark
🔘 B. Sqlmap
🔘 C. Burp Suite
🔘 D. Metasploit
✅ Answer: B
Explanation: Sqlmap is an automated tool that detects and exploits SQL Injection vulnerabilities.
33. What is the risk of using dynamic SQL queries with user input?
🔘 A. It slows down performance
🔘 B. It can allow SQL Injection attacks
🔘 C. It increases memory usage
🔘 D. It requires more code
✅ Answer: B
Explanation: Dynamic queries that concatenate user input can be injected with malicious SQL code.
34. What type of SQL Injection attack uses out-of-band techniques to extract data?
🔘 A. Blind SQL Injection
🔘 B. Out-of-Band SQL Injection
🔘 C. Error-Based SQL Injection
🔘 D. Time-Based SQL Injection
✅ Answer: B
Explanation: Out-of-Band SQL Injection sends results via DNS or HTTP requests, useful when direct output is unavailable.
35. Which query would be vulnerable to SQL Injection?
🔘 A. SELECT * FROM users WHERE username = ?
🔘 B. SELECT * FROM users WHERE username = '$user'
🔘 C. SELECT * FROM users WHERE username = :username
🔘 D. SELECT * FROM users WHERE username = $1
✅ Answer: B
Explanation: String concatenation with user input ('$user') makes it vulnerable to SQL Injection.
36. What is a common sign of an attempted SQL Injection attack?
🔘 A. Increased CPU usage
🔘 B. Sudden database crashes
🔘 C. Strange error messages related to SQL syntax
🔘 D. Slow internet speed
✅ Answer: C
Explanation: Attackers often receive SQL syntax errors when testing injection techniques.
37. Which function in SQL Server helps prevent SQL Injection by limiting execution of dynamic queries?
🔘 A. sp_executesql
🔘 B. execute
🔘 C. db_exec
🔘 D. run_query
✅ Answer: A
Explanation: sp_executesql allows execution of parameterized queries, reducing SQL Injection risks.
38. What is the impact of an SQL Injection attack?
🔘 A. Unauthorized data access
🔘 B. Database corruption
🔘 C. System takeover
🔘 D. All of the above
✅ Answer: D
Explanation: SQL Injection can lead to data theft, modification, and complete system compromise.
39. What is an example of an SQL Injection payload?
🔘 A. DROP TABLE users;
🔘 B. 1=1 --
🔘 C. ' OR '1'='1
🔘 D. All of the above
✅ Answer: D
Explanation: These payloads attempt to alter SQL logic or delete data.
40. Why is it dangerous to display SQL error messages to users?
🔘 A. It slows down performance
🔘 B. It reveals database structure and vulnerabilities
🔘 C. It causes data duplication
🔘 D. It logs too much information
✅ Answer: B
Explanation: Error messages can disclose table names, column details, and SQL syntax, helping attackers craft better payloads.
41. What is a second-order SQL Injection attack?
🔘 A. When an attack is executed immediately
🔘 B. When the injected SQL is stored and executed later
🔘 C. When an attacker modifies login credentials
🔘 D. When an attack is prevented by a WAF
✅ Answer: B
Explanation: Second-order SQL Injection stores injected input in the database, which later executes during a different database operation.
42. Which security measure is the most effective against SQL Injection?
🔘 A. Using HTTPS
🔘 B. Implementing CSP (Content Security Policy)
🔘 C. Using Prepared Statements and Parameterized Queries
🔘 D. Encrypting database backups
✅ Answer: C
Explanation: Prepared statements prevent input from being interpreted as SQL commands.
43. What is the most dangerous outcome of an SQL Injection attack?
🔘 A. Slow database performance
🔘 B. Full compromise of the database and underlying system
🔘 C. Unauthorized API access
🔘 D. Reduced query efficiency
✅ Answer: B
Explanation: Attackers can escalate SQLi to Remote Code Execution (RCE), leading to full system compromise.
44. What is “Hex Encoding” in SQL Injection?
🔘 A. A method to bypass security filters
🔘 B. A way to encrypt SQL queries
🔘 C. A secure input validation technique
🔘 D. A SQL database command
✅ Answer: A
Explanation: Hex encoding (e.g., 0x313133) allows attackers to bypass security filters by encoding malicious SQL queries.
45. What type of SQL Injection attack manipulates an application’s HTTP headers?
🔘 A. Error-Based SQL Injection
🔘 B. Header-Based SQL Injection
🔘 C. Time-Based SQL Injection
🔘 D. Out-of-Band SQL Injection
✅ Answer: B
Explanation: Header-Based SQL Injection manipulates HTTP headers, such as User-Agent or Referer, to inject malicious SQL queries.
46. Which of the following security mechanisms is NOT effective against SQL Injection?
🔘 A. Using Web Application Firewalls (WAF)
🔘 B. Implementing Content Security Policy (CSP)
🔘 C. Using Parameterized Queries
🔘 D. Validating and sanitizing user inputs
✅ Answer: B
Explanation: CSP (Content Security Policy) is used for XSS (Cross-Site Scripting) prevention, not SQL Injection.
47. Which of these is an example of a Boolean-Based Blind SQL Injection payload?
🔘 A. ' OR 1=1 --
🔘 B. ' AND 1=2 --
🔘 C. ' UNION SELECT null,null --
🔘 D. DROP TABLE users;
✅ Answer: B
Explanation: Boolean-Based Blind SQL Injection works by evaluating conditions (1=2), observing responses, and inferring database structure.
48. How does an attacker determine the number of columns in a UNION-based SQL Injection attack?
🔘 A. Using ORDER BY n in the injected query
🔘 B. Checking for errors in the SQL syntax
🔘 C. Modifying HTTP request headers
🔘 D. By encrypting the SQL query
✅ Answer: A
Explanation: Attackers use ORDER BY followed by an increasing number (ORDER BY 1, ORDER BY 2, etc.) to identify the number of columns.
49. What is a major limitation of SQL Injection in NoSQL databases (e.g., MongoDB)?
🔘 A. NoSQL databases do not use SQL queries
🔘 B. NoSQL databases are fully secure by design
🔘 C. NoSQL databases do not store user data
🔘 D. NoSQL does not allow user authentication
✅ Answer: A
Explanation: NoSQL databases (like MongoDB) do not use SQL syntax, but they can be vulnerable to NoSQL Injection.
50. Which database privilege should be avoided for web application accounts to limit SQL Injection impact?
🔘 A. SELECT
🔘 B. INSERT
🔘 C. DROP
🔘 D. UPDATE
✅ Answer: C
Explanation: DROP privileges allow attackers to delete entire database tables, making SQL Injection attacks more destructive.
51. What is “Batch SQL Injection”?
🔘 A. Executing multiple SQL statements in a single request
🔘 B. Injecting SQL into batch scripts
🔘 C. Using multiple databases for SQL Injection
🔘 D. A method of bypassing firewalls
✅ Answer: A
Explanation: Batch SQL Injection occurs when an application allows multiple SQL statements to be executed in a single query.
52. Which of these techniques helps prevent SQL Injection in stored procedures?
🔘 A. Using dynamic SQL inside stored procedures
🔘 B. Parameterizing all input variables
🔘 C. Allowing direct user input in stored procedures
🔘 D. Disabling stored procedures
✅ Answer: B
Explanation: Stored procedures should use parameterized inputs to avoid SQL Injection.
53. How do attackers use SQL Injection to bypass login authentication?
🔘 A. By injecting 1=1 conditions
🔘 B. By using double quotes instead of single quotes
🔘 C. By using JavaScript to bypass the login page
🔘 D. By encrypting their SQL queries
✅ Answer: A
Explanation: Injecting conditions like ' OR '1'='1' -- always evaluates to TRUE, bypassing authentication.
54. What is a limitation of Time-Based Blind SQL Injection?
🔘 A. It is detectable by WAFs
🔘 B. It takes longer to extract data
🔘 C. It only works on MySQL
🔘 D. It cannot be automated
✅ Answer: B
Explanation: Time-based attacks use delays (SLEEP()), making data extraction slow compared to other techniques.
55. How does a WAF help prevent SQL Injection attacks?
🔘 A. By encrypting SQL queries
🔘 B. By blocking malicious payload patterns
🔘 C. By disabling SQL features
🔘 D. By converting SQL queries to NoSQL
✅ Answer: B
Explanation: Web Application Firewalls (WAFs) inspect incoming traffic for SQL Injection patterns and block suspicious requests.
56. Which modern security approach is most effective against SQL Injection?
🔘 A. Secure coding practices
🔘 B. Using only HTTPS
🔘 C. Storing SQL queries in encrypted files
🔘 D. Disabling JavaScript in browsers
✅ Answer: A
Explanation: Writing secure code (using prepared statements and least privilege access) is the best defense against SQL Injection.
57. What is the purpose of an SQL Injection cheat sheet?
🔘 A. To provide pre-made attack payloads
🔘 B. To help developers prevent SQL Injection
🔘 C. To automate SQL attacks
🔘 D. To replace prepared statements
✅ Answer: B
Explanation: SQL Injection cheat sheets (like OWASP’s) help developers identify and fix security flaws.
58. What does an attacker achieve with SELECT @@VERSION in SQL Injection?
🔘 A. Extracts database version information
🔘 B. Bypasses authentication
🔘 C. Deletes database tables
🔘 D. Encrypts the SQL query
✅ Answer: A
Explanation: SELECT @@VERSION reveals database version details, helping attackers tailor their attacks.
59. How do attackers exfiltrate data using Out-of-Band SQL Injection?
🔘 A. By extracting data through email notifications
🔘 B. By using external HTTP/DNS requests
🔘 C. By writing to the database log files
🔘 D. By encoding the data in Base64
✅ Answer: B
Explanation: Out-of-Band SQL Injection sends data to an external attacker via HTTP, DNS, or email.
60. Which of these is an advanced SQL Injection payload for MySQL?
🔘 A. UNION SELECT NULL, NULL, @@datadir --
🔘 B. SELECT * FROM users WHERE username = '$input'
🔘 C. SELECT FROM users WHERE id=1
🔘 D. CREATE TABLE attack;
✅ Answer: A
Explanation: UNION SELECT NULL, NULL, @@datadir -- allows attackers to enumerate MySQL directories and extract database files.
61. What is the primary goal of a SQL Injection attack?
🔘 A. To increase database performance
🔘 B. To gain unauthorized access to data or manipulate it
🔘 C. To improve indexing in SQL databases
🔘 D. To prevent database administrators from running queries
✅ Answer: B
Explanation: SQL Injection is used by attackers to steal, modify, or delete data stored in a database.
62. What type of SQL Injection attack attempts to extract data without triggering database errors?
🔘 A. Error-Based SQL Injection
🔘 B. Boolean-Based Blind SQL Injection
🔘 C. UNION-Based SQL Injection
🔘 D. Batch SQL Injection
✅ Answer: B
Explanation: Boolean-Based Blind SQL Injection works by injecting true/false conditions and observing application behavior without causing errors.
63. Which of the following is NOT a common SQL Injection technique?
🔘 A. UNION-Based SQL Injection
🔘 B. Reflected SQL Injection
🔘 C. Boolean-Based SQL Injection
🔘 D. Stored SQL Injection
✅ Answer: B
Explanation: Reflected attacks are common in XSS (Cross-Site Scripting), not SQL Injection.
64. What is the best method to prevent SQL Injection in PHP applications?
🔘 A. Using mysql_query() with user input
🔘 B. Using htmlspecialchars() to escape input
🔘 C. Using prepared statements with PDO or MySQLi
🔘 D. Allowing all special characters in input fields
✅ Answer: C
Explanation: Prepared statements ensure that user input is always treated as data, preventing SQL Injection.
65. Why is LIMIT 1 sometimes used in SQL Injection attacks?
🔘 A. To prevent detection by WAFs
🔘 B. To retrieve only one record, avoiding errors
🔘 C. To increase query execution speed
🔘 D. To make attacks more complex
✅ Answer: B
Explanation: Attackers use LIMIT 1 to avoid fetching multiple records and making the attack less noticeable.
66. What is a “stacked query” in SQL Injection?
🔘 A. Executing multiple queries in a single statement
🔘 B. Using complex subqueries
🔘 C. Injecting SQL into stored procedures
🔘 D. Encrypting SQL Injection payloads
✅ Answer: A
Explanation: Stacked queries allow execution of multiple SQL commands in a single request (e.g., SELECT * FROM users; DROP TABLE users;).
67. What is the most effective way to test for SQL Injection vulnerabilities?
🔘 A. Manually entering ' OR 1=1 -- in input fields
🔘 B. Using automated tools like sqlmap
🔘 C. Reviewing database logs
🔘 D. Using encrypted SQL queries
✅ Answer: B
Explanation: Automated tools like sqlmap can efficiently test and exploit SQL Injection vulnerabilities.
68. How do attackers bypass basic input validation in SQL Injection attacks?
🔘 A. By encoding input in Base64
🔘 B. By using comments (--, #, /* */)
🔘 C. By using case-insensitive SQL keywords
🔘 D. All of the above
✅ Answer: D
Explanation: Attackers use Base64 encoding, SQL comments, and case variations to bypass weak input validation.
69. What does UNION SELECT null,null -- do in an SQL Injection attack?
🔘 A. Retrieves multiple rows from the database
🔘 B. Checks for column count compatibility in a UNION-based attack
🔘 C. Drops the table if NULL values exist
🔘 D. Converts all database entries to NULL
✅ Answer: B
Explanation: Attackers use UNION SELECT null,null -- to identify the number of columns before extracting data.
70. Why is dynamic SQL dangerous when handling user input?
🔘 A. It increases database performance
🔘 B. It allows attackers to inject malicious SQL commands
🔘 C. It prevents SQL Injection
🔘 D. It is required for executing stored procedures
✅ Answer: B
Explanation: Dynamic SQL concatenates user input into queries, making it vulnerable to SQL Injection.
71. Which type of SQL Injection attack targets XML-based databases?
🔘 A. Blind SQL Injection
🔘 B. XPath Injection
🔘 C. Boolean-Based SQL Injection
🔘 D. UNION-Based SQL Injection
✅ Answer: B
Explanation: XPath Injection exploits XML-based databases, similar to how SQL Injection targets relational databases.
72. What is “Polyglot SQL Injection”?
🔘 A. An SQL Injection attack that works across multiple DBMS
🔘 B. A SQL Injection that requires multiple encodings
🔘 C. A technique that encrypts malicious SQL queries
🔘 D. A method for testing multiple SQL queries at once
✅ Answer: A
Explanation: Polyglot SQL Injection is a technique where a single payload is crafted to work across multiple database management systems (DBMS).
73. What does SELECT table_name FROM information_schema.tables; do in an SQL Injection attack?
🔘 A. Retrieves a list of tables in the database
🔘 B. Deletes all tables in the database
🔘 C. Encrypts the database schema
🔘 D. Displays all user credentials
✅ Answer: A
Explanation: information_schema.tables contains metadata about all database tables, which is useful for enumeration.
74. How can an attacker exfiltrate data from a database without direct output?
🔘 A. DNS-based data exfiltration
🔘 B. HTTP error responses
🔘 C. Using side-channel timing attacks
🔘 D. All of the above
✅ Answer: D
Explanation: Attackers use DNS requests, HTTP responses, and timing analysis to extract data even when direct output is restricted.
75. What SQL function is commonly exploited in time-based attacks?
🔘 A. BENCHMARK()
🔘 B. NOW()
🔘 C. RAND()
🔘 D. COUNT()
✅ Answer: A
Explanation: BENCHMARK() in MySQL is used to artificially delay query execution, aiding time-based SQL Injection.
76. How do hackers use LOAD_FILE('/etc/passwd') in MySQL SQL Injection?
🔘 A. To upload malicious files
🔘 B. To read system files on the server
🔘 C. To encrypt database tables
🔘 D. To execute shell commands
✅ Answer: B
Explanation: LOAD_FILE() allows attackers to read system files, exposing sensitive configuration data.
77. Which SQL Injection method is the hardest to detect?
🔘 A. Error-Based SQL Injection
🔘 B. UNION-Based SQL Injection
🔘 C. Blind SQL Injection
🔘 D. Second-Order SQL Injection
✅ Answer: D
Explanation: Second-Order SQL Injection is difficult to detect because malicious queries are stored and executed later.
78. Which modern authentication method significantly reduces SQL Injection risks?
🔘 A. Basic Authentication
🔘 B. Token-Based Authentication (JWT, OAuth)
🔘 C. CAPTCHA verification
🔘 D. MD5 password hashing
✅ Answer: B
Explanation: Token-Based Authentication (like JWT, OAuth) prevents direct SQL-based login bypass attacks.
79. How does an SQL Injection attack differ from a Command Injection attack?
🔘 A. SQL Injection targets web databases, while Command Injection affects OS commands
🔘 B. Command Injection is only possible in Windows
🔘 C. SQL Injection cannot modify database contents
🔘 D. Command Injection uses JavaScript
✅ Answer: A
Explanation: SQL Injection exploits databases, while Command Injection allows execution of system commands.
80. What is “Time Delay Injection”?
🔘 A. Forcing the database to delay response to infer data
🔘 B. Injecting SQL after a time limit expires
🔘 C. Using a scheduler to automate SQL Injection
🔘 D. Encrypting queries before execution
✅ Answer: A
Explanation: Attackers use delays (SLEEP(n)) to infer whether an SQL query was executed.
81. Which database feature can help prevent SQL Injection by limiting input execution time?
🔘 A. Execution Timeout
🔘 B. SQL Caching
🔘 C. Rate Limiting
🔘 D. Query Optimization
✅ Answer: A
Explanation: Execution Timeout can prevent long-running malicious queries from executing indefinitely in SQL Injection attacks.
82. What is the main advantage of using Object-Relational Mapping (ORM) for database interaction?
🔘 A. ORM prevents SQL Injection by using abstraction layers
🔘 B. ORM speeds up database queries significantly
🔘 C. ORM eliminates the need for database authentication
🔘 D. ORM converts SQL queries into NoSQL
✅ Answer: A
Explanation: ORM frameworks (like SQLAlchemy, Hibernate, Django ORM) use parameterized queries, reducing SQL Injection risks.
83. Which of the following is NOT a sign of an SQL Injection attempt?
🔘 A. Sudden database slowdowns
🔘 B. Unusual database error messages
🔘 C. Increased network latency
🔘 D. A surge in failed login attempts
✅ Answer: C
Explanation: SQL Injection affects the database layer, not network latency.
84. How can security teams detect SQL Injection attempts in real-time?
🔘 A. Manual database audits
🔘 B. Intrusion Detection Systems (IDS)
🔘 C. Disabling SQL commands
🔘 D. Rewriting all queries manually
✅ Answer: B
Explanation: IDS and SIEM systems monitor suspicious SQL queries and block potential attacks in real time.
85. What is the primary risk of allowing “dynamic WHERE clauses” in SQL queries?
🔘 A. They allow faster query execution
🔘 B. They introduce SQL Injection risks
🔘 C. They improve database indexing
🔘 D. They prevent unauthorized access
✅ Answer: B
Explanation: Dynamic WHERE clauses can concatenate user input directly into SQL queries, making them vulnerable.
86. What is the impact of “time-based blind SQL Injection” on the target system?
🔘 A. Immediate database dump
🔘 B. Performance degradation due to repeated SLEEP() queries
🔘 C. Direct file access
🔘 D. Database user privilege escalation
✅ Answer: B
Explanation: Time-based SQL Injection uses commands like SLEEP(10) to introduce artificial delays, which can slow down performance.
87. Why is xp_cmdshell dangerous in SQL Server?
🔘 A. It allows attackers to execute OS commands via SQL queries
🔘 B. It enables automatic database indexing
🔘 C. It bypasses firewall restrictions
🔘 D. It improves query performance
✅ Answer: A
Explanation: xp_cmdshell in SQL Server can be abused for Remote Code Execution (RCE) through SQL Injection.
88. How does an attacker use ' OR 'x'='x in SQL Injection?
🔘 A. To retrieve encrypted passwords
🔘 B. To force the query to always return TRUE
🔘 C. To disable authentication
🔘 D. To perform a DoS attack
✅ Answer: B
Explanation: ' OR 'x'='x always evaluates TRUE, allowing attackers to bypass authentication.
89. How does setting a “deny all” default policy in a firewall help against SQL Injection?
🔘 A. It blocks all unauthorized requests
🔘 B. It speeds up SQL queries
🔘 C. It prevents SQL queries from executing
🔘 D. It encrypts SQL queries
✅ Answer: A
Explanation: A default deny policy ensures that only explicitly allowed queries are executed, reducing risks.
90. How do hackers use “Error-Based SQL Injection” to extract data?
🔘 A. By causing SQL errors that return database information
🔘 B. By manipulating the browser console
🔘 C. By modifying database indexing
🔘 D. By brute-forcing SQL queries
✅ Answer: A
Explanation: Attackers trigger SQL errors that leak database structure details, helping them refine attacks.
91. Which SQL statement is the MOST dangerous if improperly secured?
🔘 A. SELECT
🔘 B. UPDATE
🔘 C. DELETE
🔘 D. DROP
✅ Answer: D
Explanation: DROP statements can delete entire databases, causing permanent data loss in SQL Injection attacks.
92. Why should database credentials never be stored in plaintext?
🔘 A. Attackers can easily access them if compromised
🔘 B. It reduces database query speed
🔘 C. It improves data compression
🔘 D. It prevents remote access
✅ Answer: A
Explanation: Storing plaintext credentials makes databases an easy target in data breaches.
93. How can attackers exfiltrate data using DNS-Based SQL Injection?
🔘 A. By encoding SQL results in DNS queries
🔘 B. By modifying DNS records
🔘 C. By exploiting browser vulnerabilities
🔘 D. By injecting JavaScript into SQL queries
✅ Answer: A
Explanation: DNS-based SQL Injection encodes stolen data in DNS requests sent to an attacker-controlled server.
94. What is “Hybrid SQL Injection”?
🔘 A. A mix of multiple SQL Injection techniques
🔘 B. An attack that targets hybrid cloud databases
🔘 C. A NoSQL-based SQL Injection attack
🔘 D. A method for encrypting SQL Injection payloads
✅ Answer: A
Explanation: Hybrid SQL Injection combines Boolean, Error-Based, UNION-Based, and Time-Based techniques.
95. Which security control helps prevent SQL Injection at the database level?
🔘 A. Using Least Privilege Principle
🔘 B. Running SQL queries as root
🔘 C. Disabling database authentication
🔘 D. Encrypting SQL tables
✅ Answer: A
Explanation: Limiting privileges ensures attackers cannot execute unauthorized queries.
96. Which header can be used to prevent SQL Injection payloads in web applications?
🔘 A. X-Frame-Options
🔘 B. Content-Security-Policy
🔘 C. Strict-Transport-Security
🔘 D. Referrer-Policy
✅ Answer: B
Explanation: Content-Security-Policy (CSP) can help mitigate reflected SQL Injection attacks.
97. Which of the following is a recommended security measure for APIs to prevent SQL Injection?
🔘 A. Using GraphQL instead of REST APIs
🔘 B. Allowing only GET requests
🔘 C. Implementing prepared statements
🔘 D. Encrypting all API responses
✅ Answer: C
Explanation: Prepared statements prevent SQL Injection in APIs handling user input.
98. What is an example of “Nested SQL Injection”?
🔘 A. Injecting an SQL query inside another query
🔘 B. Running SQL Injection in hidden forms
🔘 C. Using multiple encoding techniques
🔘 D. Injecting SQL inside an API
✅ Answer: A
Explanation: Nested SQL Injection involves inserting a subquery inside another query, making detection harder.
99. What makes NoSQL databases different in terms of SQL Injection risk?
🔘 A. They do not use SQL syntax
🔘 B. They have built-in SQL Injection protection
🔘 C. They encrypt all queries
🔘 D. They only allow read operations
✅ Answer: A
Explanation: NoSQL databases (e.g., MongoDB, Firebase) use JSON-like syntax, making traditional SQL Injection ineffective.
100. What is a common SQL Injection attack against login forms?
🔘 A. ' OR '1'='1' --
🔘 B. ORDER BY 1
🔘 C. UPDATE users SET password = 'hacked'
🔘 D. DROP TABLE users
✅ Answer: A
Explanation: ' OR '1'='1' -- bypasses authentication by always evaluating TRUE, granting access.
101. What is an “Automated SQL Injection” attack?
🔘 A. An attack that uses scripts or tools to inject SQL queries
🔘 B. An SQL Injection attack that runs without user interaction
🔘 C. An SQL Injection attack targeting AI-based databases
🔘 D. A manually executed SQL Injection attack
✅ Answer: A
Explanation: Automated SQL Injection uses tools like sqlmap to detect and exploit SQL vulnerabilities efficiently.
102. What is a common challenge in detecting SQL Injection attacks?
🔘 A. They often generate legitimate-looking queries
🔘 B. They always require an authenticated session
🔘 C. They can only target stored procedures
🔘 D. They do not leave any logs
✅ Answer: A
Explanation: Many SQL Injection payloads look like normal queries, making detection harder without specialized tools.
103. What SQL keyword is often abused in SQL Injection attacks to extract data?
🔘 A. FROM
🔘 B. WHERE
🔘 C. UNION
🔘 D. LIMIT
✅ Answer: C
Explanation: The UNION keyword allows attackers to merge query results, potentially leaking sensitive data.
104. What does an attacker achieve with SELECT @@hostname in SQL Injection?
🔘 A. Retrieves the database server’s hostname
🔘 B. Executes remote shell commands
🔘 C. Deletes all database records
🔘 D. Encrypts all SQL queries
✅ Answer: A
Explanation: @@hostname exposes the name of the database server, useful for reconnaissance.
105. How do attackers use nested queries in SQL Injection?
🔘 A. To execute multiple SQL queries inside a single query
🔘 B. To speed up database performance
🔘 C. To bypass WAF protections
🔘 D. To trigger SQL caching mechanisms
✅ Answer: A
Explanation: Nested queries allow attackers to execute multiple subqueries, extracting sensitive data.
106. What is “Encoding-Based SQL Injection”?
🔘 A. An attack that uses encoded payloads to bypass security filters
🔘 B. A method for encrypting SQL queries
🔘 C. A technique that only works on NoSQL databases
🔘 D. An SQL Injection attack that modifies database indexing
✅ Answer: A
Explanation: Attackers encode payloads (Base64, HEX, URL-encoding) to bypass input validation and WAFs.
107. What is an effective countermeasure against second-order SQL Injection?
🔘 A. Input validation only
🔘 B. Encrypting all database responses
🔘 C. Parameterized queries and stored procedures
🔘 D. Using SQL wildcards
✅ Answer: C
Explanation: Parameterized queries and stored procedures prevent SQL Injection in stored data.
108. What is the purpose of using INFORMATION_SCHEMA.COLUMNS in an SQL Injection attack?
🔘 A. To list all available columns in a database
🔘 B. To encrypt database tables
🔘 C. To modify authentication rules
🔘 D. To generate a brute-force attack
✅ Answer: A
Explanation: INFORMATION_SCHEMA.COLUMNS allows attackers to list all column names, aiding in data extraction.
109. Which of these would help an attacker determine the database type in an SQL Injection attack?
🔘 A. SELECT version();
🔘 B. SELECT @@version;
🔘 C. SELECT DATABASE();
🔘 D. All of the above
✅ Answer: D
Explanation: These queries reveal database version and type, helping attackers tailor their SQL Injection payloads.
110. Why should user input never be directly concatenated into SQL queries?
🔘 A. It slows down database performance
🔘 B. It increases the risk of SQL Injection
🔘 C. It is not supported by NoSQL databases
🔘 D. It prevents proper indexing
✅ Answer: B
Explanation: Concatenating user input into SQL queries makes them vulnerable to SQL Injection.
111. What role does “Least Privilege Access” play in SQL Injection prevention?
🔘 A. It ensures users have only the necessary permissions
🔘 B. It speeds up query execution
🔘 C. It allows all users to execute queries
🔘 D. It removes the need for authentication
✅ Answer: A
Explanation: Restricting user permissions ensures attackers cannot execute harmful SQL commands.
112. How can attackers bypass a Web Application Firewall (WAF) in an SQL Injection attack?
🔘 A. By using encoded payloads
🔘 B. By manipulating case sensitivity
🔘 C. By using time delays
🔘 D. All of the above
✅ Answer: D
Explanation: Attackers use encoding, case manipulation, and time-based techniques to evade WAF detection.
113. What is “Log-Based SQL Injection”?
🔘 A. Injecting malicious SQL queries into database logs
🔘 B. Exploiting database logging features to extract data
🔘 C. Overwriting database logs to avoid detection
🔘 D. Injecting SQL queries through a logging system
✅ Answer: B
Explanation: Log-Based SQL Injection manipulates database logs to extract sensitive information.
114. Why is error suppression (@ in PHP) ineffective for SQL Injection prevention?
🔘 A. It only hides errors without fixing vulnerabilities
🔘 B. It prevents users from logging in
🔘 C. It encrypts database queries
🔘 D. It stops SQL Injection completely
✅ Answer: A
Explanation: Hiding errors does not prevent SQL Injection; the vulnerability still exists.
115. What is a “NoSQL Injection” attack?
🔘 A. Injecting malicious code into NoSQL databases
🔘 B. Converting NoSQL databases into SQL databases
🔘 C. Using SQL queries in NoSQL environments
🔘 D. Encrypting NoSQL queries
✅ Answer: A
Explanation: NoSQL Injection targets NoSQL databases (e.g., MongoDB) by manipulating query structures.
116. How does an attacker use SHOW TABLES in SQL Injection?
🔘 A. To list all tables in the database
🔘 B. To delete all tables
🔘 C. To modify authentication rules
🔘 D. To encrypt table structures
✅ Answer: A
Explanation: SHOW TABLES reveals all available tables, aiding enumeration in SQL Injection.
117. What is an SQL Injection “Payload”?
🔘 A. The injected SQL query that executes malicious actions
🔘 B. A backup of the target database
🔘 C. A legal statement protecting against SQL Injection
🔘 D. A database indexing technique
✅ Answer: A
Explanation: An SQL Injection payload is the crafted SQL input used to exploit a vulnerability.
118. How does “Database Mirroring” help prevent SQL Injection damage?
🔘 A. By keeping a backup copy of the database
🔘 B. By preventing unauthorized queries
🔘 C. By allowing read-only access to mirrored copies
🔘 D. Both A and C
✅ Answer: D
Explanation: Database mirroring keeps a backup and limits direct modification of mirrored copies.
119. How does “Prepared Statement Batching” improve security?
🔘 A. By executing multiple safe queries efficiently
🔘 B. By allowing dynamic queries
🔘 C. By caching SQL responses
🔘 D. By removing query execution limits
✅ Answer: A
Explanation: Batching prepared statements allows multiple secure queries without SQL Injection risks.
120. What is “Self-Blind SQL Injection”?
🔘 A. An attacker injects SQL queries but cannot see the output directly
🔘 B. An attacker extracts data using XSS
🔘 C. An attacker manipulates SQL queries via hidden forms
🔘 D. An SQL Injection attack that relies on API endpoints
✅ Answer: A
Explanation: Self-Blind SQL Injection occurs when attackers inject queries but infer results indirectly.
121. How does an attacker use “SQL Injection in JSON-based APIs”?
🔘 A. By injecting SQL queries inside JSON parameters
🔘 B. By modifying JSON schema definitions
🔘 C. By encrypting JSON payloads
🔘 D. By manipulating API headers
✅ Answer: A
Explanation: Attackers inject malicious SQL payloads inside JSON parameters to exploit API vulnerabilities.
122. Which HTTP header can sometimes be used to perform an SQL Injection attack?
🔘 A. User-Agent
🔘 B. Referer
🔘 C. X-Forwarded-For
🔘 D. All of the above
✅ Answer: D
Explanation: Attackers can inject SQL payloads into HTTP headers, which are then processed by backend applications.
123. Why are “comment markers” (--, #, /* */) useful in SQL Injection?
🔘 A. They allow attackers to ignore unwanted parts of queries
🔘 B. They speed up SQL query execution
🔘 C. They improve query readability
🔘 D. They disable database authentication
✅ Answer: A
Explanation: SQL comments truncate remaining query parts, allowing attackers to alter query logic.
124. What is “Case-Sensitive SQL Injection Evasion”?
🔘 A. Using uppercase and lowercase variations to bypass filters
🔘 B. Injecting SQL into case-sensitive databases only
🔘 C. Encrypting SQL queries to evade detection
🔘 D. Using time-based payloads
✅ Answer: A
Explanation: Some security filters are case-sensitive, allowing attackers to evade detection using variations (UnIoN SeLeCt).
125. What is the impact of “Truncation-Based SQL Injection”?
🔘 A. It exploits data truncation to bypass authentication
🔘 B. It corrupts database tables
🔘 C. It speeds up SQL queries
🔘 D. It prevents SQL Injection
✅ Answer: A
Explanation: Truncation attacks force username/password values to be truncated, sometimes leading to unintended access.
126. What does INFORMATION_SCHEMA.TABLES reveal in an SQL Injection attack?
🔘 A. List of all tables in the database
🔘 B. User authentication details
🔘 C. Encrypted database records
🔘 D. Firewall logs
✅ Answer: A
Explanation: INFORMATION_SCHEMA.TABLES provides a list of all database tables, aiding attackers in enumeration.
127. Why is CHAR() sometimes used in SQL Injection?
🔘 A. To inject obfuscated SQL payloads
🔘 B. To decode encrypted SQL queries
🔘 C. To execute database backups
🔘 D. To bypass two-factor authentication
✅ Answer: A
Explanation: CHAR() allows attackers to inject characters using ASCII values, bypassing security filters.
128. How does “Error Suppression” affect SQL Injection attempts?
🔘 A. It makes SQL Injection harder by hiding error messages
🔘 B. It prevents SQL Injection entirely
🔘 C. It improves SQL query execution speed
🔘 D. It disables logging
✅ Answer: A
Explanation: Suppressing SQL errors (@ in PHP, TRY...CATCH in SQL Server) hides valuable debugging information from attackers.
129. What is an “Error-Based Boolean Attack” in SQL Injection?
🔘 A. A method where attackers cause SQL errors to infer data
🔘 B. A way to retrieve full database dumps
🔘 C. A technique that bypasses login authentication
🔘 D. An attack that exploits NULL values
✅ Answer: A
Explanation: Attackers inject Boolean conditions into queries and use error messages to infer data.
130. What is the risk of storing SQL queries inside client-side JavaScript?
🔘 A. Attackers can modify them to execute malicious SQL commands
🔘 B. It improves website speed
🔘 C. It prevents SQL Injection
🔘 D. It encrypts database transactions
✅ Answer: A
Explanation: Storing SQL queries in JavaScript is dangerous because attackers can modify them before they reach the server.
131. Which type of SQL Injection is the most difficult to detect?
🔘 A. Error-Based SQL Injection
🔘 B. Time-Based Blind SQL Injection
🔘 C. UNION-Based SQL Injection
🔘 D. Batch SQL Injection
✅ Answer: B
Explanation: Time-Based Blind SQL Injection does not return visible errors, making detection challenging.
132. What is “SQL Injection via Cookies”?
🔘 A. An attack where SQL payloads are stored in cookies
🔘 B. An attack that modifies SQL database indexing
🔘 C. A technique that forces SQL errors using HTTP headers
🔘 D. A method to inject SQL into API tokens
✅ Answer: A
Explanation: Cookies are often processed in SQL queries, allowing attackers to inject malicious SQL payloads.
133. What does LOAD DATA INFILE do in SQL Injection attacks?
🔘 A. Reads files from the system into the database
🔘 B. Modifies user authentication tokens
🔘 C. Prevents unauthorized SQL execution
🔘 D. Encrypts SQL queries
✅ Answer: A
Explanation: LOAD DATA INFILE allows reading local files, which can be abused to extract sensitive system files.
134. Why is INFORMATION_SCHEMA.ROUTINES valuable in an SQL Injection attack?
🔘 A. It reveals stored procedures and functions
🔘 B. It increases SQL execution speed
🔘 C. It encrypts database logs
🔘 D. It allows privilege escalation
✅ Answer: A
Explanation: INFORMATION_SCHEMA.ROUTINES helps attackers find stored procedures that may have vulnerabilities.
135. What is an “SQL Injection Bypass” technique?
🔘 A. A method to evade security controls and filters
🔘 B. A way to encrypt SQL Injection queries
🔘 C. A process for fixing SQL Injection vulnerabilities
🔘 D. A method for optimizing SQL queries
✅ Answer: A
Explanation: Attackers use SQL Injection bypass techniques (encoding, comments, nesting) to evade security controls.
136. What is a “White-Box SQL Injection Test”?
🔘 A. A security test where the attacker has full knowledge of the system
🔘 B. An SQL Injection attack on cloud databases
🔘 C. A way to encrypt SQL queries
🔘 D. A test that targets AI-based databases
✅ Answer: A
Explanation: White-Box Testing means attackers (or testers) have full access to the application’s source code and SQL structure.
137. Why is “AI-Powered SQL Injection Detection” gaining popularity?
🔘 A. AI can analyze large datasets to identify attack patterns
🔘 B. AI automatically patches SQL vulnerabilities
🔘 C. AI speeds up SQL query execution
🔘 D. AI prevents all SQL Injection attacks
✅ Answer: A
Explanation: AI-powered security tools detect anomalies in SQL queries, improving SQL Injection detection.
138. What does SHOW PROCESSLIST reveal in an SQL Injection attack?
🔘 A. Active database processes, including running queries
🔘 B. User authentication tokens
🔘 C. Encrypted database logs
🔘 D. API request headers
✅ Answer: A
Explanation: SHOW PROCESSLIST reveals active queries, which attackers can use to analyze database operations.
139. How do attackers use “Time-Based SQL Injection” for reconnaissance?
🔘 A. By causing database delays to infer query results
🔘 B. By executing SQL Injection inside stored procedures
🔘 C. By modifying database timestamps
🔘 D. By bypassing API security controls
✅ Answer: A
Explanation: Attackers use SLEEP(n) or BENCHMARK() to measure query response times and extract data indirectly.
140. What is a “Database Fingerprinting Attack” in SQL Injection?
🔘 A. Identifying database type and version using SQL queries
🔘 B. Encrypting SQL queries for authentication
🔘 C. Generating SQL logs for performance analysis
🔘 D. Using NoSQL Injection in traditional databases
✅ Answer: A
Explanation: Attackers use database fingerprinting to identify the DBMS (MySQL, SQL Server, PostgreSQL), helping them craft targeted SQL Injection payloads.
141. What is an “SQL Injection Proxy Attack”?
🔘 A. Using an intermediary server to launch SQL Injection attacks
🔘 B. An SQL Injection attack that targets proxy servers
🔘 C. A technique to encrypt SQL Injection queries
🔘 D. A method to modify SQL queries without detection
✅ Answer: A
Explanation: Attackers use proxies to obfuscate their origin and launch SQL Injection attacks through different IP addresses.
142. Which database privilege should be removed to reduce SQL Injection risks?
🔘 A. DROP
🔘 B. ALTER
🔘 C. EXECUTE
🔘 D. All of the above
✅ Answer: D
Explanation: Restricting dangerous privileges like DROP, ALTER, and EXECUTE helps prevent SQL Injection exploitation.
143. How can attackers use SQL Injection in search queries?
🔘 A. By injecting wildcards (%, _) to manipulate results
🔘 B. By modifying query logic to return unintended results
🔘 C. By using UNION to extract sensitive data
🔘 D. All of the above
✅ Answer: D
Explanation: Attackers manipulate search queries using SQL Injection techniques to extract data or disrupt application behavior.
144. How does an attacker use GROUP_CONCAT() in an SQL Injection attack?
🔘 A. To concatenate multiple database values into a single output
🔘 B. To execute SQL commands remotely
🔘 C. To create a brute-force attack on SQL queries
🔘 D. To encrypt database records
✅ Answer: A
Explanation: GROUP_CONCAT() combines multiple rows into a single string, allowing attackers to extract multiple values in a single query.
145. What is a “Delayed SQL Injection Attack”?
🔘 A. An attack where injected queries execute at a later time
🔘 B. A method for encrypting SQL queries
🔘 C. A technique to slow down database queries
🔘 D. A time-based brute-force SQL attack
✅ Answer: A
Explanation: Delayed SQL Injection (or Second-Order SQL Injection) stores malicious input, which executes later when retrieved.
146. What is “Blind SQL Injection in Login Forms”?
🔘 A. Injecting SQL queries without seeing direct output
🔘 B. A brute-force SQL Injection attack
🔘 C. Encrypting login credentials before injecting SQL
🔘 D. A technique only applicable to PostgreSQL
✅ Answer: A
Explanation: Blind SQL Injection does not return error messages, so attackers infer results based on system behavior.
147. What does HAVING help an attacker achieve in an SQL Injection attack?
🔘 A. Bypass filtering and execute conditions on grouped data
🔘 B. Modify the structure of database tables
🔘 C. Encrypt SQL queries before execution
🔘 D. Prevent SQL Injection
✅ Answer: A
Explanation: Attackers use HAVING to filter and manipulate SQL query results, bypassing some security mechanisms.
148. Why is using LOAD_FILE() in MySQL dangerous?
🔘 A. It allows attackers to read arbitrary files from the server
🔘 B. It improves database performance
🔘 C. It encrypts SQL queries
🔘 D. It prevents SQL Injection
✅ Answer: A
Explanation: LOAD_FILE() can be exploited to read system files (e.g., /etc/passwd), exposing sensitive data.
149. How do attackers use SQL Injection in file upload functionalities?
🔘 A. By modifying file metadata to contain SQL Injection payloads
🔘 B. By injecting SQL through filename parameters
🔘 C. By modifying database queries used for file handling
🔘 D. All of the above
✅ Answer: D
Explanation: File upload functionalities that store filenames in databases can be exploited for SQL Injection.
150. Why is INFORMATION_SCHEMA.COLUMNS valuable for an SQL Injection attacker?
🔘 A. It lists all column names in the database
🔘 B. It encrypts SQL queries
🔘 C. It modifies SQL constraints
🔘 D. It prevents SQL Injection
✅ Answer: A
Explanation: INFORMATION_SCHEMA.COLUMNS helps attackers enumerate table structures for further exploitation.
151. How can SQL Injection lead to “Privilege Escalation”?
🔘 A. By exploiting stored procedures to gain higher access
🔘 B. By modifying user privileges in the database
🔘 C. By injecting malicious SQL into admin-level queries
🔘 D. All of the above
✅ Answer: D
Explanation: SQL Injection can modify privileges, execute high-level commands, or exploit stored procedures, leading to privilege escalation.
152. What is “Federated SQL Injection”?
🔘 A. An attack targeting linked or federated databases
🔘 B. A method for securing SQL queries
🔘 C. An encryption technique for SQL queries
🔘 D. A NoSQL-based SQL Injection attack
✅ Answer: A
Explanation: Federated SQL Injection exploits federated or linked databases, where queries execute across multiple systems.
153. How does an attacker use BENCHMARK() in SQL Injection?
🔘 A. To slow down query execution and confirm vulnerabilities
🔘 B. To speed up SQL queries
🔘 C. To brute-force SQL credentials
🔘 D. To prevent SQL Injection
✅ Answer: A
Explanation: BENCHMARK() artificially delays queries, helping attackers measure SQL Injection success through response time.
154. How do attackers evade SQL Injection detection?
🔘 A. By using URL encoding
🔘 B. By injecting whitespace variations
🔘 C. By using nested queries
🔘 D. All of the above
✅ Answer: D
Explanation: Attackers use encoding, whitespace manipulation, and query nesting to evade detection.
155. Why is “Stored Procedure SQL Injection” dangerous?
🔘 A. It bypasses many traditional security filters
🔘 B. It allows attackers to execute administrative SQL commands
🔘 C. It can execute system-level commands
🔘 D. All of the above
✅ Answer: D
Explanation: Stored procedure vulnerabilities allow attackers to bypass input validation, execute OS commands, and escalate privileges.
156. What is “Heap-Based SQL Injection”?
🔘 A. An attack targeting in-memory database operations
🔘 B. A technique that modifies database indexing
🔘 C. A method that affects NoSQL databases
🔘 D. A technique that encrypts SQL Injection queries
✅ Answer: A
Explanation: Heap-Based SQL Injection targets in-memory database operations, allowing temporary data manipulation.
157. Why is UNION SELECT ALL dangerous in SQL Injection?
🔘 A. It retrieves duplicate values, increasing the data leak risk
🔘 B. It allows attackers to execute multiple queries
🔘 C. It improves SQL Injection performance
🔘 D. It encrypts query results
✅ Answer: A
Explanation: UNION SELECT ALL returns duplicate values, increasing data exposure in SQL Injection attacks.
158. How does “AI-Assisted SQL Injection” work?
🔘 A. AI models craft advanced SQL Injection payloads
🔘 B. AI automatically patches SQL vulnerabilities
🔘 C. AI speeds up query execution
🔘 D. AI prevents SQL Injection
✅ Answer: A
Explanation: AI can automate SQL Injection attacks by learning from attack patterns and generating optimized payloads.
159. How does “DNS Exfiltration SQL Injection” work?
🔘 A. Attackers extract data via DNS queries
🔘 B. SQL queries modify DNS records
🔘 C. SQL Injection queries are encrypted over DNS
🔘 D. Attackers block database logging via DNS
✅ Answer: A
Explanation: DNS Exfiltration SQL Injection sends stolen data encoded inside DNS queries to an attacker’s server.
160. What is a “Hybrid SQL Injection” attack?
🔘 A. Combining multiple SQL Injection techniques
🔘 B. Targeting both SQL and NoSQL databases
🔘 C. Encrypting SQL Injection queries
🔘 D. Executing SQL Injection in cloud environments
✅ Answer: A
Explanation: Hybrid SQL Injection combines multiple techniques (UNION-Based, Boolean-Based, Time-Based) for maximum effectiveness.
161. What is “AI-Powered SQL Injection Defense”?
🔘 A. AI models analyze queries to detect SQL Injection attempts
🔘 B. AI encrypts SQL Injection payloads
🔘 C. AI speeds up SQL query execution
🔘 D. AI automatically exploits SQL Injection vulnerabilities
✅ Answer: A
Explanation: AI-powered defenses use machine learning models to detect SQL Injection patterns in real time.
162. How does an attacker exploit “SQL Injection via WebSockets”?
🔘 A. By injecting SQL queries through WebSocket communication channels
🔘 B. By modifying SQL logs using WebSockets
🔘 C. By injecting JavaScript into SQL queries
🔘 D. By disabling WebSockets
✅ Answer: A
Explanation: WebSockets bypass traditional security filters, allowing attackers to inject SQL payloads.
163. What is an “SQL Injection Exploit Kit”?
🔘 A. A set of tools for automating SQL Injection attacks
🔘 B. A software for securing SQL databases
🔘 C. A framework for encrypting SQL queries
🔘 D. A legal compliance tool for database security
✅ Answer: A
Explanation: Exploit kits automate SQL Injection attacks, making them more efficient.
164. What does XP_FILEEXIST() do in SQL Injection attacks?
🔘 A. Checks if a specific file exists on the system
🔘 B. Encrypts SQL queries
🔘 C. Modifies SQL database logs
🔘 D. Deletes system files
✅ Answer: A
Explanation: XP_FILEEXIST() can reveal sensitive system files, aiding attackers in file enumeration.
165. How does “Automated Payload Mutation” enhance SQL Injection attacks?
🔘 A. It generates new payloads dynamically to bypass filters
🔘 B. It improves database performance
🔘 C. It encrypts all SQL Injection queries
🔘 D. It prevents SQL Injection
✅ Answer: A
Explanation: Automated payload mutation helps attackers evade detection by modifying SQL Injection payloads.
166. What is “Deferred SQL Injection”?
🔘 A. When SQL Injection is stored and executed later
🔘 B. A method that prevents SQL Injection
🔘 C. A way to prioritize SQL queries
🔘 D. A NoSQL-based attack
✅ Answer: A
Explanation: Deferred SQL Injection (Second-Order Injection) stores malicious input, which executes later.
167. How does “Virtual Patching” help mitigate SQL Injection?
🔘 A. It applies security fixes at the web application firewall level
🔘 B. It modifies the database schema
🔘 C. It encrypts SQL queries
🔘 D. It disables SQL logging
✅ Answer: A
Explanation: Virtual patching applies temporary security fixes at the WAF level until the actual patch is implemented.
168. What is an “SQL Injection Honeypot”?
🔘 A. A decoy system designed to detect and track attackers
🔘 B. A method to automate SQL Injection
🔘 C. A tool that prevents SQL Injection
🔘 D. A framework for securing databases
✅ Answer: A
Explanation: SQL Injection honeypots are decoy systems used to detect, log, and analyze SQL Injection attempts.
169. How do attackers use SELECT @@TIMESTAMP in SQL Injection?
🔘 A. To check the system’s current time and infer database details
🔘 B. To encrypt SQL queries
🔘 C. To disable logging
🔘 D. To perform brute-force attacks
✅ Answer: A
Explanation: SELECT @@TIMESTAMP helps attackers determine system behavior and response times.
170. Why are “Blind Time-Based SQL Injection” attacks difficult to detect?
🔘 A. They do not return error messages
🔘 B. They bypass web application firewalls
🔘 C. They only work on NoSQL databases
🔘 D. They do not affect database performance
✅ Answer: A
Explanation: Time-Based SQL Injection relies on query execution delays, without triggering direct errors.
171. What is the risk of allowing xp_cmdshell in SQL Server?
🔘 A. Attackers can execute system commands via SQL Injection
🔘 B. It improves query performance
🔘 C. It allows for faster indexing
🔘 D. It prevents unauthorized access
✅ Answer: A
Explanation: xp_cmdshell enables Remote Code Execution (RCE), allowing attackers to execute system-level commands.
172. How does an attacker use STUFF() in SQL Injection?
🔘 A. To modify and manipulate string-based SQL queries
🔘 B. To perform brute-force attacks
🔘 C. To encrypt SQL queries
🔘 D. To bypass authentication
✅ Answer: A
Explanation: STUFF() manipulates string data, allowing attackers to modify query structures dynamically.
173. What is “SQL Injection over DNS”?
🔘 A. An attack that exfiltrates data using DNS queries
🔘 B. A way to modify DNS records using SQL Injection
🔘 C. A technique that prevents SQL Injection
🔘 D. A database indexing optimization
✅ Answer: A
Explanation: Attackers encode stolen data in DNS requests, allowing exfiltration even when direct database access is blocked.
174. Why is “Multi-Stage SQL Injection” more dangerous?
🔘 A. It involves multiple attack steps to exploit deep vulnerabilities
🔘 B. It only affects NoSQL databases
🔘 C. It prevents SQL Injection
🔘 D. It requires administrator privileges
✅ Answer: A
Explanation: Multi-Stage SQL Injection executes in sequential steps, allowing attackers to bypass advanced security measures.
175. How does an attacker use EXEC() in SQL Injection?
🔘 A. To execute dynamic SQL commands
🔘 B. To perform brute-force attacks
🔘 C. To prevent SQL Injection
🔘 D. To modify encryption settings
✅ Answer: A
Explanation: EXEC() executes dynamic SQL, making it a common target for SQL Injection.
176. What is “Command Chaining SQL Injection”?
🔘 A. Executing multiple SQL commands in a single injection
🔘 B. Encrypting SQL Injection payloads
🔘 C. Modifying database indexing
🔘 D. Injecting NoSQL queries into SQL databases
✅ Answer: A
Explanation: Command chaining executes multiple SQL commands, increasing attack impact.
177. How do attackers use sysobjects in SQL Injection?
🔘 A. To list database objects like tables and procedures
🔘 B. To encrypt SQL queries
🔘 C. To disable SQL Injection protection
🔘 D. To perform brute-force attacks
✅ Answer: A
Explanation: sysobjects contains metadata about database structures, useful for enumeration attacks.
178. Why is sp_addlogin dangerous in SQL Injection?
🔘 A. Attackers can create new database users with elevated privileges
🔘 B. It speeds up SQL queries
🔘 C. It encrypts database records
🔘 D. It disables logging
✅ Answer: A
Explanation: Attackers use sp_addlogin to create new privileged accounts, escalating access.
179. How can an attacker exploit sysdatabases in SQL Injection?
🔘 A. To list all databases on the server
🔘 B. To encrypt SQL queries
🔘 C. To perform brute-force attacks
🔘 D. To optimize SQL query performance
✅ Answer: A
Explanation: sysdatabases reveals the list of databases, helping attackers identify potential targets.
180. What is the role of “Error-Based Out-of-Band SQL Injection”?
🔘 A. It sends extracted data to an external server using error messages
🔘 B. It encrypts SQL Injection payloads
🔘 C. It prevents database access
🔘 D. It modifies SQL query logs
✅ Answer: A
Explanation: Out-of-Band SQL Injection sends extracted data via alternative channels (DNS, HTTP requests).
181. How does an attacker use INTO OUTFILE in SQL Injection?
🔘 A. To write database query results into a file on the server
🔘 B. To encrypt SQL queries
🔘 C. To disable SQL Injection detection
🔘 D. To modify system logs
✅ Answer: A
Explanation: INTO OUTFILE allows attackers to write query results to a file, potentially creating a backdoor.
182. What is “Stealth SQL Injection”?
🔘 A. An attack that minimizes logs and traces
🔘 B. A method for securing SQL queries
🔘 C. A technique used only in PostgreSQL
🔘 D. A brute-force attack
✅ Answer: A
Explanation: Stealth SQL Injection avoids triggering security alerts or logs, making it harder to detect.
183. How do attackers use sysprocesses in SQL Injection?
🔘 A. To monitor active database queries and processes
🔘 B. To encrypt SQL queries
🔘 C. To bypass authentication
🔘 D. To optimize SQL query performance
✅ Answer: A
Explanation: sysprocesses provides information about currently running queries, which attackers can use for reconnaissance.
184. What is a “Compound SQL Injection Attack”?
🔘 A. A combination of multiple SQL Injection techniques
🔘 B. A technique used in NoSQL environments
🔘 C. A method to prevent SQL Injection
🔘 D. A way to automate SQL queries
✅ Answer: A
Explanation: Compound SQL Injection combines techniques like Error-Based, Time-Based, and UNION-Based attacks for maximum exploitation.
185. How does an attacker use sp_configure in SQL Injection?
🔘 A. To modify database security settings
🔘 B. To speed up SQL queries
🔘 C. To prevent SQL Injection
🔘 D. To encrypt user credentials
✅ Answer: A
Explanation: sp_configure can alter database configurations, allowing attackers to weaken security settings.
186. What is “Multi-Vector SQL Injection”?
🔘 A. Using multiple entry points to inject SQL payloads
🔘 B. A method for encrypting SQL queries
🔘 C. A brute-force attack on SQL queries
🔘 D. A technique that prevents SQL Injection
✅ Answer: A
Explanation: Multi-Vector SQL Injection exploits various attack surfaces (URL parameters, headers, cookies, POST data).
187. How does an attacker use INSERT INTO in SQL Injection?
🔘 A. To insert malicious records into the database
🔘 B. To delete all user data
🔘 C. To encrypt database tables
🔘 D. To optimize SQL queries
✅ Answer: A
Explanation: Attackers use INSERT INTO to inject persistent malicious data, which can be executed later.
188. What is the risk of allowing SELECT * FROM users WHERE id=$user_id?
🔘 A. It allows SQL Injection if $user_id is not validated
🔘 B. It prevents query optimization
🔘 C. It requires administrator privileges
🔘 D. It speeds up SQL execution
✅ Answer: A
Explanation: Using unvalidated user input in queries allows SQL Injection exploits.
189. How does “Cross-Database SQL Injection” work?
🔘 A. An attack that targets multiple databases on the same server
🔘 B. A method that prevents SQL Injection
🔘 C. A way to automate SQL queries
🔘 D. A brute-force attack
✅ Answer: A
Explanation: Cross-Database SQL Injection occurs when a vulnerable query accesses multiple databases, allowing attackers to escalate access.
190. How does xp_regread help an attacker in SQL Injection?
🔘 A. It reads Windows Registry values via SQL
🔘 B. It encrypts SQL queries
🔘 C. It prevents SQL Injection
🔘 D. It modifies database indexes
✅ Answer: A
Explanation: xp_regread allows attackers to access Windows Registry values, which can expose system configurations.
191. Why is “AI-Generated SQL Injection Payloads” a growing concern?
🔘 A. AI can craft more effective SQL Injection attacks
🔘 B. AI speeds up SQL execution
🔘 C. AI encrypts SQL queries
🔘 D. AI prevents SQL Injection
✅ Answer: A
Explanation: AI models can generate SQL Injection payloads that evade detection.
192. How does “Cloud SQL Injection” differ from traditional SQL Injection?
🔘 A. It targets cloud-hosted databases with different architectures
🔘 B. It only works on SQL Server databases
🔘 C. It prevents SQL Injection
🔘 D. It requires administrator privileges
✅ Answer: A
Explanation: Cloud SQL Injection exploits security misconfigurations in cloud-hosted databases.
193. What is “JWT SQL Injection”?
🔘 A. Injecting SQL queries into JSON Web Tokens (JWTs)
🔘 B. A way to encrypt SQL queries
🔘 C. A NoSQL attack method
🔘 D. A technique to speed up SQL execution
✅ Answer: A
Explanation: JWT SQL Injection modifies JWT tokens to inject malicious SQL queries.
194. How do attackers use DBCC commands in SQL Injection?
🔘 A. To manipulate database integrity settings
🔘 B. To encrypt SQL queries
🔘 C. To delete SQL logs
🔘 D. To perform brute-force attacks
✅ Answer: A
Explanation: DBCC commands allow database diagnostics, which attackers can abuse to extract sensitive data.
195. What is the role of “AI-Based SQL Injection Detection Systems”?
🔘 A. Detecting and blocking SQL Injection attempts using AI
🔘 B. Encrypting SQL queries
🔘 C. Preventing database modifications
🔘 D. Speeding up SQL queries
✅ Answer: A
Explanation: AI-based security tools analyze SQL query patterns to detect and block SQL Injection attacks.
196. How does “Metadata SQL Injection” work?
🔘 A. Exploiting metadata tables to extract sensitive information
🔘 B. Encrypting metadata logs
🔘 C. Preventing SQL Injection
🔘 D. Modifying SQL query execution order
✅ Answer: A
Explanation: Metadata SQL Injection allows attackers to query database system tables, extracting schema details.
197. What is “API SQL Injection”?
🔘 A. Injecting SQL payloads through web APIs
🔘 B. Encrypting API responses
🔘 C. Preventing SQL Injection
🔘 D. Bypassing authentication via SQL queries
✅ Answer: A
Explanation: APIs that interact with databases are vulnerable to SQL Injection attacks through API endpoints.
198. Why are “Hybrid SQL Injection Attacks” more effective?
🔘 A. They combine multiple SQL Injection techniques for maximum exploitation
🔘 B. They are slower and harder to detect
🔘 C. They require special authentication tokens
🔘 D. They only work on cloud databases
✅ Answer: A
Explanation: Hybrid SQL Injection mixes techniques like Time-Based, Boolean-Based, and Error-Based attacks.
199. How does “NoSQL Injection” differ from SQL Injection?
🔘 A. It targets NoSQL databases like MongoDB
🔘 B. It uses SQL queries in NoSQL databases
🔘 C. It encrypts NoSQL queries
🔘 D. It speeds up query execution
✅ Answer: A
Explanation: NoSQL Injection exploits document-based databases (e.g., MongoDB) using JSON manipulation.
200. What is the risk of “Nested SQL Injection”?
🔘 A. It allows injecting SQL into subqueries and nested statements
🔘 B. It encrypts all SQL queries
🔘 C. It prevents database corruption
🔘 D. It speeds up SQL query execution
✅ Answer: A
Explanation: Nested SQL Injection exploits subqueries, making detection harder.