Multiple choice technology security

Developer wrote the query as "select empname,phone,e-mail from emp where empid="+empid;

  1. 101 union all select * from proj;

  2. 101 union all select pname,1,1 from proj;

  3. 101 union all select pname from proj;

  4. 101 union all select pid,pname, pcost from proj;
Reveal answer Fill a bubble to check yourself
B,D Correct answer
Explanation

This is a SQL injection vulnerability. The query concatenates empid directly into SQL: empid="+empid. If empid is "101 union all select pname,1,1 from proj;" (Option B), the injection succeeds because UNION ALL requires matching column count (3 columns) and compatible types (string, number, number). Option D also works: "101 union all select pid,pname,pcost from proj;" matches the 3-column structure. Options A and C fail: A selects * (unknown columns), C selects only 1 column (mismatch).

Keep practicing — related questions