Exam 350-901 topic 1 question 306 discussion

Actual exam question from Cisco's 350-901

Question #: 306
Topic #: 1

Refer to the exhibit. The code fetches the latest order from the purchases table for a specific user. An engineer needs to pass query parameters to the execute function to prevent an SQL injection attack. Which code snippet must be placed in the blank in the code to meet this requirement?

A. cursor.execute("SELECT orders FROM purchases WHERE
username = '{}'".format (username))
B. cursor.execute("SELECT orders FROM purchases WHERE
username = %(username)s", {'username': username})
C. cursor.execute("SELECT orders FROM purchases WHERE
username = '$s' % username".replace("'", "''"))
D. cursor.execute (f"SELECT orders FROM purchases WHERE
username = '{username}'")

Show Suggested Answer

Suggested Answer: B 🗳️

by hatsec at Jan. 14, 2023, 3:54 a.m.

Comments

Submit Cancel

ldlpi

Highly Voted 1 year, 2 months ago

Selected Answer: B

B is a parameterization method, better for SQL Injection; C is a ecaping method, better for XSS according to the DevCore study guide Moreover C has a syntax error Moreover ChatGPT sais B: This code is using Python to execute a SQL query against a database using parameterized queries to prevent SQL injection attacks. Specifically, it is selecting the orders column from the purchases table where the username column matches the username variable. The username variable is passed in as a parameter in a dictionary format using the % operator to substitute the value into the query string. This approach is recommended for preventing SQL injection attacks because it ensures that user input is treated as data rather than as part of the SQL statement itself.

upvoted 7 times

i9t6

11 months, 4 weeks ago

A clear explanation of all this answers and why B is correct https://realpython.com/prevent-python-sql-injection/

upvoted 4 times

...

samael666

Most Recent 5 months ago

Selected Answer: B

the use of placeholder and key value will prevent inject SQL injection.

upvoted 1 times

...

cj_kuo

1 year, 2 months ago

Selected Answer: B

Regarding to the MySQL Document, it presented following demo code: select_stmt = "SELECT * FROM employees WHERE emp_no = %(emp_no)s" cursor.execute(select_stmt, { 'emp_no': 2 }) Therefore, I choose the answer B as the correct one.

upvoted 3 times

...

alexgrt

1 year, 4 months ago

Selected Answer: D

This is getting discussed a lot so I took the Time to write some code and test this. Here is my code: https://gist.github.com/Ghiritaia/0e07dc4ed05763738298453927c05450. Answers A and D are the same and therefore correct. I'll go with D because is the cleaner code.

upvoted 3 times

...

it0

1 year, 4 months ago

I think the answer could be C, as the other answers do not do any escaping, only C does. The following syntax is correct >>> print(" what is '%s' " % ("hello".replace("","")))

upvoted 1 times