Week 5 Topic 2: Inserting data using SQL

Which SQL clause is used to add new data to a table?

In the context of SQL, what is the primary reason for using the bindValue() function?

Why should variables generally not be directly included in SQL queries?

Which HTTP method should you use for submitting a form that will alter the database?

When are quotes necessary around column names in an SQL INSERT INTO statement?

What is the purpose of the UPDATE clause in SQL?

In PHP, which function is used to bind a value to a placeholder in a prepared SQL statement to prevent SQL injection?

Which of the following is a security risk associated with directly embedding variables into SQL queries?

Consider the following SQL statement: INSERT INTO Products (Name, Price) VALUES ('$name', $price);. What is the primary security concern with this statement?

What is the main purpose of using prepared statements with placeholders in database interactions?

Which of the following is the most secure way to include user-supplied data in an SQL query?

What is a potential vulnerability if you directly use a variable in an SQL query without proper sanitization?

In the context of web security, what does SQL injection refer to?

If user input is directly concatenated into an SQL query without sanitization, what type of security vulnerability is most likely to occur?

Which SQL clause is used for modifying existing data in a database table?

What is the primary reason for using prepared statements with bound parameters instead of directly embedding variables into SQL queries?

Which of the following is a critical step in preventing SQL injection attacks?

What is the role of placeholders in prepared SQL statements?

How does using parameterized queries (prepared statements) help prevent SQL injection vulnerabilities?

In the context of SQL injection, what does 'escaping' user input refer to?

Consider an online store. Which SQL action would a malicious user attempt via SQL injection to potentially view other users' credit card information?

What is the primary difference between mysqli_query() and prepared statements in PHP when interacting with a MySQL database?

In the context of SQL injection prevention, what does the principle of 'least privilege' refer to?

Which of the following is an example of input validation that can help prevent SQL injection?

What is the purpose of encoding special characters in user input before using it in an SQL query?

You discover that a form on your website is vulnerable to SQL injection. Other than switching to prepared statements, what is another immediate step you should take to mitigate the risk?

Which of the following functions is most effective at preventing SQL injection?

An attacker successfully exploited an SQL injection vulnerability by injecting malicious code into a search form. Which SQL command was most likely used to retrieve sensitive data?

A web application uses the following code to execute a query: $query = 'SELECT * FROM users WHERE username = "' . $_GET['username'] . '";'. What is the main security vulnerability?

Which of the following is NOT a recommended method for preventing SQL injection?

Which action would best protect a database from SQL injection if a developer insists on using dynamic SQL?

An attacker injects the following SQL code into a username field: ' OR '1'='1. What is the likely outcome?

A developer uses the code UPDATE products SET price = $_POST['price']WHERE product_id =$_GET['id']`` in their application. Besides using prepared statements, what immediate action can they take to reduce the risk of SQL injection?

Imagine a scenario where you are reviewing code and find the following SQL query: $sql = "SELECT * FROM items WHERE description LIKE '%" . $_GET['search'] . "%'";. How would you best refactor this query to prevent SQL injection?

What SQL injection technique involves using comments (-- or /* */) to truncate or ignore parts of the original query?

Consider a web application that uses the following code to display product details: $product_id = $_GET['id']; $query = "SELECT * FROM products WHERE id = $product_id";. An attacker crafts the following URL: www.example.com/product.php?id=1;DROP TABLE products;. What is the most likely outcome if the application uses the obsolete mysql_query function and the database user has sufficient privileges?

A developer is designing a function to search for users in a database. Which of the following approaches provides the BEST protection against SQL injection attacks?

Assume a legacy PHP application is critically vulnerable to SQL injection. Due to time constraints, a complete rewrite is impossible. What is the MOST effective short-term mitigation strategy to drastically reduce the risk of exploitation?

What is the primary purpose of the addNewProductForm.php file, as described in the content?

Why is it generally discouraged to directly use variables within SQL queries, according to the content?

In the context of inserting data into a database using SQL, what is the role of the bindValue() function?

Which HTTP method is recommended when submitting a form that will modify data in a database, such as adding a new product, and why?

Examine the following SQL statement: INSERT INTO Products (Name, Price) VALUES (?, ?);. What does the ? signify in this statement?

Under what specific condition might column names in an SQL INSERT INTO statement require quotes?

You are tasked with updating the price of a product in a database. Which SQL clause should you use?

Consider a scenario where a developer uses string concatenation to build an SQL query with user-provided data, without any sanitization or parameterization. Which type of security vulnerability is MOST likely to result?

Which of the following scenarios presents the HIGHEST risk of an SQL injection vulnerability?

A legacy PHP web application uses dynamically constructed SQL queries with user input taken directly from URL parameters. Identify the single most effective and practical short-term mitigation technique to minimize SQL injection risks without rewriting the entire application.