SQL injection is a common security threat. Which two methods would help protect against this risk? (Choose two.)

Question

Options

• Ausing stored procedures to validate values that are input
• Busing SQL variables to secure input values
• Cusing prepared statements to handle unsecured values
• Dinstalling the SQL Protection plugin to catch such attempts
• Estarting the server with the -injection-protection command-line option.

• A
  88% (35)
• C
  3% (1)
• D
  8% (3)
• E
  3% (1)

Explanation

There appears to be an error in the provided answer key - the correct answers should be A and C, not A and B.

Stored procedures (A) help prevent SQL injection by encapsulating SQL logic on the server side, reducing direct exposure of query construction to user input. Prepared statements (C) are the gold-standard defense: they separate SQL code from data by pre-compiling the query structure, so user input is always treated as a literal value and never interpreted as executable SQL.

Option B is incorrect - "SQL variables" is not a recognized or meaningful SQL injection prevention technique; it's a distractor that sounds technical but describes nothing concrete.

Options D and E are fictional - there is no standard "SQL Protection plugin" or -injection-protection server flag in MySQL or any major RDBMS; these are classic exam distractors designed to test whether you know real tools from invented ones.

Memory tip: Think "P" for Protection - Prepared statements and stored Procedures are your two real defenses. If an answer sounds like a magic toggle or plugin that does all the work for you, it's almost certainly a distractor.

No community discussion yet for this question.