Free CAS-004 Web TestEngine Demo

Q47 Single choice

A systems engineer is reviewing output from a web application vulnerability scan. The engineer has determined data is entenng the application from an untrusted source and is being used to construct a query dynamically.

Which of the following code snippets would BEST protect the application against an SQL injection attack?

A
String input = request.getParameter ("SeqNo");
String characterPattern = "[0-9a0zA-Z]
If (! input. Matches (characterPattern))
{
out.println ("Invalid Input");
}
B
Cinput type= "text" maxlength= "30" name=
"ecsChangePwdForm" size= "40" readonly= "true"
value= '<%=ESAPI.encoder().encodeForHTML
(request.getParameter("userName")) %>'/>
C
catch (Exception e)
{
if (log.isDebugEnabled()) log.debug (context, EVENTS.ADHOC,
"Caught InvalidGSMException Exception --"
+ e.toString() );
}
D
<asp:TextBox Tablndex= "6" runat= "server" Width= "206px"
MaxLength= "11" TextMode= "Password"X/asp:TextBox>

CAS-004 Web TestEngine demo