Questions

Answer the following questions to test your knowledge of this chapter:

1. Try to figure out the SQL injection risk in your already-developed applications. Have you focused on the implicit Date and Time conversions? How can your solution be updated to eliminate it?
2. Use the data model shown in Figure 14.1. Assume that the following query is used to produce the name and surname values of the employee. Each employee is uniquely identified by the employee_id attribute value. The required value of the employee_id value is user specified:

   select name, surname
    from personal_data
         join employment using (personal_id)
      where employee_id=INPUT_VAL;

Which input value provides SQL injection and produces all the names and surnames, irrespective of the provided employee ID?

1. NULL
2. IS NULL
3. 1=1
4. 1 or 1=1