What enables input fields to execute data manipulation commands?

SY0-701 By islever Editorial Last updated

Short answer

D SQL injection

Question

Which of the following enables the use of an input field to run commands that can view or manipulate data?
  1. Cross-site scripting
  2. Side loading
  3. Buffer overflow
  4. SQL injection Correct Answer

Key Takeaways

This question tests the distinction between client-side scripting attacks and database-specific command execution, where the trap is confusing Cross-site scripting (XSS) with SQL injection.

SQL injection is a vulnerability where attackers insert malicious SQL statements into input fields to interact directly with a database. The community confirms this is the specific technique used to view or manipulate backend data via input queries.

Common mistake: Choosing Cross-site scripting (XSS) is a common mistake because it also involves input fields and data manipulation, but XSS targets the client-side browser rather than the backend database.

Expert Analysis

Why the Answer Is Correct

SQL injection (SQLi) allows attackers to interfere with the queries an application makes to its database. By inserting malicious SQL statements into an input field, an attacker can trick the database into executing unintended commands, such as revealing, modifying, or deleting sensitive data. This directly matches the question's description of using an input field to run commands that manipulate data.

Why the Other Options Are Wrong

Cross-site scripting (XSS) attacks the user's browser rather than the database, executing scripts to steal cookies or redirect users, not to run database commands. Side loading refers to installing applications from unauthorized sources, which is unrelated to input field vulnerabilities. Buffer overflow is a memory corruption error caused by writing more data than a buffer can hold, distinct from injection attacks.

Community Comment Notes

The community consensus strongly supports SQL injection, emphasizing that it is the only option involving direct database command execution via input fields. One commenter noted that while XSS can manipulate data, it does so on the client side, whereas the question implies backend data manipulation. Therefore, SQL injection is the definitive correct answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Look for keywords like 'input field' combined with 'database' or 'data manipulation' to identify SQL injection. Remember that XSS targets the client, while SQLi targets the server-side database.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Etc_Shadow28000 👍 24 Answered D
    The correct answer is: D. SQL injection SQL injection is a type of attack that involves inserting malicious SQL statements into an input field. These statements can then be executed by the database, allowing the attacker to view or manipulate the data. This can lead to unauthorized access to the database, data leakage, or even the modification and deletion of data. Here’s why the other options are not correct in this context: - A. This involves injecting malicious scripts into webpages viewed by other users, but it does not specifically involve running commands that directly view or manipulate data in a database. - B This typically refers to installing applications from unofficial sources, not related to input fields and running commands. -C. This involves exploiting a program by writing more data to a buffer than it can hold, potentially allowing the execution of arbitrary code, but it does not specifically use input fields to run commands on data.
  2. metzen227 👍 14
    SQL injection: SQL injection involves inserting malicious SQL queries into input fields or other user-controllable data sources to manipulate the database backend. By exploiting SQL injection vulnerabilities, attackers can execute arbitrary SQL commands that can view, modify, or delete data stored in the database. This technique directly enables the use of an input field to run commands that manipulate data. Therefore, the correct answer is SQL injection. It allows attackers to execute commands through input fields to manipulate data within a database.
  3. PAWarriors 👍 2 Answered D
    Correct answer is D (SQL injection). > SQL injection Involves inserting malicious SQL code into input fields.
  4. shootweb 👍 1 Answered D
    Even though I believe the answer is D (SQLi) I still think A (XSS) is a valid answer. The question does not specify whether "data" refers specifically to application data or database data. If the question explicitly mentioned "database data," then SQL Injection (D) would be 100% correct. Why can it be A then? When an XSS script runs, it can view, modify, or exfiltrate data. A simple example would be grabbing and replacing cookies, which requires the ability to view and manipulate data. XSS can also exhibit CSRF-like behavior, as it can steal a session and use it to interact with APIs as if it were the victim, which also requires viewing and manipulating data.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide