Question

Which of the following script is an example of Quick detection in the SQL injection attack?

(a) SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID

(b) For integer inputs : convert(int,@@version)

(c) IF condition true-part ELSE false-part (S)

(d) SELECT header, txt FROM news UNION ALL SELECT name, pass FROM members

The question was asked in homework.

I would like to ask this question from SQL Injection in chapter Developing with SQL Server of SQL Server

Answer 1

Right choice is (b) For integer inputs : convert(int,@@version)

The best I can explain: Quick detection attacks should throw conversion errors.