Study. uk . com
  1. Home
  2. All questions
  3. Question 468

CISSP study material · question 468 of 500

A reporting feature lets users pick which database table to report on by supplying its name. Why does OWASP treat this as dangerous even with parameterised values?

  1. Table names are always logged in clear text, exposing the schema.
  2. Structure names such as tables and columns cannot be escaped, so user-supplied structure names remain hazardous.
  3. Reporting tools bypass the application's authorisation layer by design.
  4. Parameterisation applies only to numeric values, not to strings.
Show the answer

Answer: B. Structure names such as tables and columns cannot be escaped, so user-supplied structure names remain hazardous.

OWASP notes SQL structures such as table and column names cannot be escaped, making user-supplied structure names dangerous, and calls this a common issue in report-writing software.

Source: OWASP Top 10 A05:2025 (OWASP) — OWASP Top 10:2025 A05 Injection > How to prevent

Challenge yourself on this topic → Study as cards