Exam objective
CEHSQL Injection
This objective sits in Web Application Hacking, which carries 14% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.
Objective title verbatim from the official objectives. EC-Council exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A developer builds a query by appending a request parameter to a string and hands the result to a statement object. What makes this pattern injectable?
Correct.
Checked against cheatsheetseries.owasp.org, September 2026Concept
A database engine cannot tell where a developer's instructions end and a caller's value begins when both arrive as one string. The flaw sits in how the statement was assembled, never in the value itself.
Why B
An unvalidated parameter appended to the query text is taken by the database as part of the command, so whatever the caller writes is executed rather than read as data.
Source
OWASP Cheat Sheet Series, SQL Injection Prevention, checked September 2026A common SQL injection flaw in Java is shown below. Because its unvalidated "customerName" parameter is simply appended to the query, an attacker can enter SQL code into that query and the application would take the attacker's code and execute it on the database.
Now you: practice questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team rewrites its data layer to use prepared statements with variable binding. Which property makes that a primary defense?
Sample question 2 of 3
An analyst reviews SQL Server stored procedures and must decide which ones still carry injection risk. Which construct should the search target?
Sample question 3 of 3
A team moves all data access into stored procedures and grants the web account rights to run them. Which new risk does the change introduce?
That’s 3 of the full CEH bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.