What attacks can get realized due to below code? ... Connection con = null; Statement stmt = null; try{ String personName = req.getParameter("PName"); String personAddress = req.getParameter("PAddress"); String personEmail = req.getParameter("PEmail"); String personPhone = req.getParameter("PPhone"); con= UtilDAO.make_con(); stmt = con.createStatement(); String sql = "INSERT INTO PersonDetails values ('"+personName+"', '"+personAddress+"', '"+personEmail+"', '"+personPhone+"')"; stmt.executeUpdate(sql); con.commit(); stmt.close(); UtilDAO.close(con); } catch(Exception e) { log.debug(“Exception is:”+e); } ...

technology security

  1. Cross Site Scripting

  2. SQL Injection

  3. Improper Resource Release

  4. Option 1 AND Option 2

  5. Option 1 AND Option 2 AND Option 3

  6. Option 2 AND Option 3

Show answer
Correct Option: E

AI Explanation

To answer this question, let's go through each option to understand why it is correct or incorrect:

Option A) Cross Site Scripting (XSS) - This option is incorrect. Cross-Site Scripting refers to injecting malicious scripts into a web application, which can then be executed by users visiting the website. The given code does not involve any user input rendering on the web page, so XSS attack is not possible.

Option B) SQL Injection - This option is correct. SQL Injection refers to manipulating or injecting malicious SQL queries into a database query. In the given code, the SQL query is constructed using string concatenation with user-provided values (personName, personAddress, personEmail, personPhone). This makes the code vulnerable to SQL Injection attacks if the user-provided values are not properly sanitized or validated.

Option C) Improper Resource Release - This option is correct. Improper Resource Release refers to not properly releasing or closing resources after they are used. In the given code, the Connection object (con) and Statement object (stmt) are not being closed in a finally block, which can lead to resource leaks.

Option D) Option 1 AND Option 2 - This option is incorrect. Option 1 refers to Cross-Site Scripting (XSS), which is not applicable in this scenario. Option 2 refers to SQL Injection, which is correct. Therefore, this option is incorrect.

Option E) Option 1 AND Option 2 AND Option 3 - This option is correct. Option 1 (Cross-Site Scripting) is not applicable, but Option 2 (SQL Injection) and Option 3 (Improper Resource Release) are both correct. Therefore, this option is correct.

Option F) Option 2 AND Option 3 - This option is incorrect. Option 2 (SQL Injection) is correct, but Option 3 (Improper Resource Release) is also correct. Therefore, this option is incorrect.

The correct answer is Option E. This option is correct because the code is vulnerable to SQL Injection attacks and also has improper resource release, which can lead to resource leaks.

Find more quizzes: