In SQL injection, which character is commonly used to terminate a string literal?

In SQL injection, which character is commonly used to terminate a string literal?

• A. Single quote
• B. Semicolon
• C. Comment
• D. Backslash

Answer: (A)

In SQL, string literals are enclosed by single quotes, and the closing single quote terminates the literal. This is why the single quote is the character used to end a string literal. If an attacker can inject input that includes another closing quote, they can break out of the string and append additional SQL, which is a common vector in SQL injection. The semicolon serves to separate statements rather than terminate a string, a comment is used to hide the rest of the injected payload, and a backslash acts as an escape in some contexts but is not the standard terminator for string literals.

In SQL, string literals are enclosed by single quotes, and the closing single quote terminates the literal. This is why the single quote is the character used to end a string literal. If an attacker can inject input that includes another closing quote, they can break out of the string and append additional SQL, which is a common vector in SQL injection. The semicolon serves to separate statements rather than terminate a string, a comment is used to hide the rest of the injected payload, and a backslash acts as an escape in some contexts but is not the standard terminator for string literals.