Question

as a penetration tester, you have found there is no data validation being completed at the server, which could leave the web applications vulnerable to sql injection attacks. which of the following could you use to help defend against this vulnerability?

always use default error messaging.
decline any entry that includes binary input, comment characters, or escape sequences.
use a higher privileged account for database connectivity.
be sure that the database server account is being run with maximum rights.

Explanation:

Analyze the vulnerability

The problem describes a lack of server-side data validation, exposing the web application to SQL injection (SQLi) attacks. SQL injection occurs when untrusted user input is directly concatenated into database queries, allowing attackers to manipulate the query structure.

Evaluate defense mechanisms

To defend against SQL injection, we must prevent malicious SQL commands from being executed.

• Always use default error messaging: Incorrect. Detailed default database errors can leak database structure to attackers (Information Disclosure).
• Decline any entry that includes binary input, comment characters, or escape sequences: Correct. This is a form of input validation/sanitization (input filtering) that blocks common SQL injection signatures (like --, /*, or ').
• Use a higher privileged account for database connectivity: Incorrect. This violates the principle of least privilege and increases the impact of a successful attack.
• Be sure that the database server account is being run with maximum rights: Incorrect. Running with maximum rights maximizes the potential damage an attacker can cause.

Connect to security concepts

Using Network Security principles, input validation and sanitization are critical controls at the application layer to block malicious payloads before they reach backend databases.

Answer:

• Always use default error messaging.
• Decline any entry that includes binary input, comment characters, or escape sequences. (Correct answer)
• Use a higher privileged account for database connectivity.
• Be sure that the database server account is being run with maximum rights.