What is the outcome of executing a vulnerable login query that ends with DROP TABLE members;--' in the same batch as a SELECT query?

What is the outcome of executing a vulnerable login query that ends with DROP TABLE members;--' in the same batch as a SELECT query?

• A. Deletes the entire members table
• B. Retrieves the password for the first user in the members table
• C. This command will not produce anything since the syntax is incorrect
• D. Inserts the Error! Reference source not found. email address into the members table

Answer: (A)

This question tests how SQL injection can run multiple statements in one batch. In a vulnerable login query, an attacker can finish the first SELECT with a semicolon, then append a second statement. The “--” comments out the rest of the line, ensuring the injected part isn’t rejected by trailing syntax. If the database user has permission and the API allows multiple statements per call, the second statement (DROP TABLE members) executes and deletes the entire table. That’s why the outcome is the deletion of the members table.

This question tests how SQL injection can run multiple statements in one batch. In a vulnerable login query, an attacker can finish the first SELECT with a semicolon, then append a second statement. The “--” comments out the rest of the line, ensuring the injected part isn’t rejected by trailing syntax. If the database user has permission and the API allows multiple statements per call, the second statement (DROP TABLE members) executes and deletes the entire table. That’s why the outcome is the deletion of the members table.