Basic pattern of vulnerabilities · Question 11 of 12
Which of the following cases follow the pattern "data turns into code"?
3 answers are correct. Hard
Show answer
Answer
- B A search term is inserted into an SQL string by concatenation
- C A comment is written into the HTML without encoding
- D A name from a form is rendered as a Fluid template
Explanation
SQL injection, template injection and XSS rely on input being interpreted as code. createNamedParameter(), in contrast, binds the value as a parameter; it remains pure data.