nerdexam
Oracle

1Z0-146 · Question #75

You created a procedure as follows: CREATE OR REPLACE PROCEDURE query_prod(twhr VARCHAR2) IS stmt VARCHAR2(100); pname VARCHAR2(20); BEGIN stmt:='SELECT product_name FROM products WHERE…

The correct answer is C. It reduces the chances of SQL injection by using bind arguments. A and D are invalid. B is invalid because you can invoke procedure for example using EXECUTE from sql*plus

Securing PL/SQL Applications

Question

You created a procedure as follows:

CREATE OR REPLACE PROCEDURE query_prod(twhr VARCHAR2) IS stmt VARCHAR2(100); pname VARCHAR2(20); BEGIN stmt:='SELECT product_name FROM products WHERE product_id=:2'; EXECUTE IMMEDIATE stmt INTO pname USING twhr; DBMS_OUTPUT.PUT_LINE(pname); END; / View the Exhibit to examine the structure of PRODUCTS table. Which statement is true about the procedure?

Exhibit

1Z0-146 question #75 exhibit

Options

  • AIt produces an error when invoked.
  • BIt can be invoked only from a PL/SQL block.
  • CIt reduces the chances of SQL injection by using bind arguments.
  • DThe values for bind arguments remain persistent in the session after the execution of the procedure.

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    81% (21)
  • D
    12% (3)

Explanation

A and D are invalid. B is invalid because you can invoke procedure for example using EXECUTE from sql*plus

Topics

#EXECUTE IMMEDIATE#bind arguments#SQL injection prevention#dynamic SQL

Community Discussion

No community discussion yet for this question.

Full 1Z0-146 Practice