SecurityIntermediate5 questions

Spot the security bug

Injection, mass assignment, output escaping and password storage in everyday Laravel code.

01What is wrong with this query?
```
$email = $request->input('email');

$users = DB::select("SELECT * FROM users WHERE email = '$email'");
```
aDB::select() cannot run SELECT statementsbUser input is concatenated into the SQL, allowing SQL injectioncThe query is missing a LIMIT clausedDouble quotes are not allowed around SQL strings in PHP
02The users table has an is_admin column and the model sets $guarded = []. What is the risk in this controller action?
```
public function store(Request $request)
{
    return User::create($request->all());
}
```
acreate() does not save the modelbThe request is not converted to JSONcA client can send is_admin=1 and set a column it should not controldEloquent will throw a MassAssignmentException
03A comment is rendered like this in a Blade view. What is the problem?
```
<div class="comment">
    {!! $comment->body !!}
</div>
```
aThe output is not escaped, so stored HTML or scripts run in visitors' browsers (XSS)bBlade will print the braces literallycThe comment body is escaped twicedThe view will fail to compile
04A Blade form posts to a route in the web middleware group and the response is "419 Page Expired". What is missing?
```
<form method="POST" action="/profile">
    <input type="text" name="name">
    <button type="submit">Save</button>
</form>
```
aAn enctype attributebThe @csrf directive (the CSRF token field)cThe @method('POST') directivedAn API token header
05Which line stores a new user's password safely?
a$user->password = md5($request->password);b$user->password = base64_encode($request->password);c$user->password = Hash::make($request->password);d$user->password = sha1($request->password);

Answers are scored on the server. Unanswered questions count as incorrect.