Which SQL injection statement example below could be used to discover the name of the table?
A)whatever%20 AND 1=(SELECT COUNT(*)FROM tabname);--
B)whatever' AND 1=(SELECT COUNT(*)FROM tabname);--
C)whatever;AND 1=(SELECT COUNT(*)FROM tabname);--
D)whatever%;AND 1=(SELECT COUNT(*)FROM tabname);--

Question

Quizplus · Accepted Answer

Option B is correct because it properly utilizes a single quote to break out of a string context in an SQL query, which is a common technique in SQL injection attacks. The syntax follows a pattern that could be used to manipulate the query to return information about the number of rows in a table named "tabname", assuming "whatever" is part of a valid query. This technique can be a step towards discovering the name of the table if the attacker iteratively guesses the table name. The "--" at the end is used to comment out the rest of the SQL statement, ensuring that only the attacker's injected SQL is executed.

Which SQL Injection Statement Example Below Could Be Used to Discover