A form allows a malicious site to open a new window and launch malware; this is most likely caused by which issue?

• A. Failure to sanitize input fields
• B. Failure to validate input fields
• C. Failure to include CAPTCHA
• D. Failure to encrypt post data

Answer: (A)

Input sanitization to prevent script injection is what this tests. When a form accepts user input and that data is later rendered or used by the page without removing or neutralizing potentially dangerous content, an attacker can inject malicious code. That code can run in the user’s browser, opening new windows or triggering malware downloads. Sanitizing input fields—removing or escaping problematic scripts and tags—stops injected code from being treated as executable content. Validation helps ensure data meets format rules but doesn’t guarantee dangerous content is neutralized, whereas CAPTCHA and encryption address other concerns (bot protection and data privacy) and don’t prevent script execution.