If a web application responds with an error after entering a stray quotation mark in a user input field, what can you infer?

If a web application responds with an error after entering a stray quotation mark in a user input field, what can you infer?

• A. SQL injection is not possible
• B. SQL injection is possible
• C. The user for line 3306 in the SQL database has a weak password
• D. The quotation mark is a valid username

Answer: (B)

When a stray quotation mark in user input triggers a server error, it signals that the application is likely inserting that input into an SQL statement without proper safeguards. The quote ends a string in SQL, so if the app concatenates input into a query without using parameterized queries or proper escaping, this can cause a syntax error. That symptom points to a potential SQL injection vulnerability, because an attacker could craft input that changes the intended SQL logic rather than just sending data. This observation doesn’t imply anything about a password or a specific user; it’s about how the backend builds database queries. The right response is to fix with safer practices like prepared statements/parameterized queries, input validation and escaping, and error handling that doesn’t reveal database details.

When a stray quotation mark in user input triggers a server error, it signals that the application is likely inserting that input into an SQL statement without proper safeguards. The quote ends a string in SQL, so if the app concatenates input into a query without using parameterized queries or proper escaping, this can cause a syntax error. That symptom points to a potential SQL injection vulnerability, because an attacker could craft input that changes the intended SQL logic rather than just sending data.

This observation doesn’t imply anything about a password or a specific user; it’s about how the backend builds database queries. The right response is to fix with safer practices like prepared statements/parameterized queries, input validation and escaping, and error handling that doesn’t reveal database details.