Practice exercise

• Which method would you employ to protect the PL/SQL code against SQL injection attacks?

  1. Replace Dynamic SQLs with Static SQLs.

  2. Replace concatenated inputs in Dynamic SQL with bind arguments.

  3. Declare the PL/SQL program to be executed by its invoker's rights.

  4. Remove string type parameters from the procedure.

• You should use static SQL to avoid SQL injection when all Oracle identifiers are known at the time of code execution.

  1. True.

  2. False.

• Choose the impact of SQL injection attacks:

  1. Malicious string inputs can extract confidential information.

  2. Unauthorized access can drop a database.

  3. It can insert the ORDER data in to the EMPLOYEES table.

  4. A procedure executed by owners, (SYS) rights can change the password of a user.

• Pick the correct strategies to fight against SQL injection:

  1. Sanitize the malicious inputs from the application layer with DBMS_ASSERT.

  2. Remove string concatenated inputs from the Oracle subprogram.

  3. Dynamic SQL should be removed from the stage.

  4. Execute a PL/SQL program with its creator...