Typing a single quote into a web application's login field produces a database syntax error that names the table being queried. Which vulnerability does this indicate, and what is the root-cause fix?
Select an answer to reveal the explanation.
Short Explanation
A single quote shouldn't break anything — unless your app is gluing what you type straight into its SQL. That error message is the app admitting it, and that's SQL injection. The real fix is parameterized queries; a WAF rule or a hidden error page is just a bandage.
Full Explanation
SQL injection occurs when an application builds a query by concatenating user input into the SQL text, so input characters change the query's structure. A lone single quote closes a string literal early, producing a syntax error; a verbose error that reveals a table name confirms both the injection point and an information leak. The root-cause fix is parameterized queries, also called prepared statements, which send the query structure and the user data separately so input is always treated as a value. Input validation, least-privilege database accounts, and generic error pages are useful additional layers but do not remove the flaw. Cross-site scripting injects script that runs in a victim's browser; HTML encoding addresses output to a page, not the construction of a database query. Command injection passes input to an operating system shell; a low-privilege service account limits its impact but is unrelated to a database syntax error. Path traversal manipulates file paths to read files outside an intended directory and has nothing to do with query syntax. Exam caveat: stored procedures are safe only when they themselves avoid dynamic SQL built from input. Operational check: review the login code for string-built queries, convert them to parameterized statements, and retest with quote characters.