問64
頻出度★★★
SQLインジェクションの対策などで用いられ, 処理の誤動作を招かないように, 利用者がWebサイトに入力した内容に含まれる有害な文字列を無害な文字列に置き換えることを何と呼ぶか。
平成28年度 春期 ITパスポート試験 問64
This question's explanation and your answers so far.
解説
問 64
- ア
正解 The correct answer is ア, Sanitizing. Sanitizing (making input harmless) refers to the process of replacing with harmless strings, or removing, the dangerous characters (such as ', <, > and the like) that are contained in the data a user enters on a website and that would be interpreted as SQL statements or scripts. This prevents attacks that abuse input values to make processing malfunction, such as SQL injection and cross-site scripting. Because it exactly matches the question description of replacing harmful character strings with harmless character strings, ア is correct.
Incorrectイ
Streaming is a delivery method in which data such as video or audio is played back sequentially as it is received, before it has all finished downloading. It has nothing to do with making input values harmless.
Incorrectウ
Tethering is a function that connects a PC or tablet to the internet by way of a mobile device such as a smartphone. It is a means of sharing a network connection and has nothing to do with the string conversion used in security countermeasures.
Incorrectエ
Reverse engineering is a technique of taking apart and analyzing an existing product or software to reveal its structure, specifications, and design information. It is a different concept from the process of making input data harmless.
ここがポイント
- Sanitizing (making input harmless) = a countermeasure that replaces or removes the dangerous characters in input values with harmless strings, thereby preventing attacks such as SQL injection and XSS. It is also closely related to escaping.
- SQL injection is an attack that slips fragments of illegitimate SQL statements into input fields to illicitly manipulate the database; its representative countermeasures are sanitizing and the use of placeholders (the bind mechanism).
用語