Which of the following is the MOST effective countermeasure against SQL Injection attacks?

Question

Options

• AUsing CAPTCHAs
• BEmploying least privilege principles only
• CValidating input with regular expressions
• DUtilizing parameterized queries or prepared statements

• C
  6% (1)
• D
  94% (17)

Explanation

Parameterized queries (prepared statements) are the gold standard against SQL injection because they separate SQL code from user-supplied data at the database driver level - the database treats input strictly as data, never as executable SQL, making injection structurally impossible. CAPTCHAs (A) only verify that a human is submitting the form and do nothing to sanitize malicious input once it reaches the database. Least privilege (B) is a valuable defense-in-depth measure that limits damage if an injection succeeds, but it doesn't prevent the attack itself. Input validation with regex (C) can catch some patterns but is notoriously brittle - attackers routinely bypass filters through encoding tricks, and the approach is a denylist rather than a safe architecture.

Memory tip: Think "separate to be safe" - parameterized queries separate code from data, which is why they're the only option that eliminates the vulnerability at its root rather than patching around it.

No community discussion yet for this question.