The OWASP Walkthroughs

1. What is a critical way Razor allows the possibility for XSS vulnerabilities?

Using `Html.Raw()` to output unencoded content HTML-encoding user inputs by default Utilizing MVC's built-in security features Using `@model.Name` in a safe context

2. Which of the following correctly describes how Entity Framework Core protects against SQL injection?

It always uses string interpolation in SQL commands It parameterizes LINQ queries automatically It requires manual input sanitization It only allows stored procedures

3. What limitation does the antiforgery token protection have in ASP.NET Core?

It cannot be used in forms It does not cover GET requests that change state It is necessary for all GET requests It is automatically included in all AJAX requests

4. Why is dynamic sorting on column/table names a risk for SQL injection?

Because it can escape the query structure Because it doesn't allow any parameterization Because it enables SQL injections through static queries Because it requires explicit parameters

Continue: Sensitive Data Scenarios → Review this lesson Retake quiz