Oracle
1Z0-146 · Question #16
Examine the following line of code that is part of a PL/SQL application: stmt:='SELECT session_id FROM sessions WHERE ' || p_where_stmt; Identify a solution for preventing SQL injection in the above…
The correct answer is B. Do not use APIs that allow arbitrary query parameters to be exposed. See the full explanation below for the reasoning.
Question
Examine the following line of code that is part of a PL/SQL application:
stmt:='SELECT session_id FROM sessions WHERE ' || p_where_stmt; Identify a solution for preventing SQL injection in the above code.
Options
- AReplace P_WHERE_STMT with a bind variable.
- BDo not use APIs that allow arbitrary query parameters to be exposed.
- CUse the RESTRICT_REFERENCES clause in the PL/SQL subprogram that contains the code.
- DUse DBMS_SQL to detect that the expression provided for P_WHERE_STMT is free from SQL injection.
How the community answered
(32 responses)- A3% (1)
- B81% (26)
- C9% (3)
- D6% (2)
Community Discussion
No community discussion yet for this question.