A security architect discovers the following while reviewing code for a company's website: selection = "SELECT Item FROM Catalog WHERE ItemID = " & Request("ItemID") Which of the following should the

The correct answer is B. Query parameterization. The code provided constructs an SQL query by directly concatenating user input (Request("ItemID")) with the query string. This approach is vulnerable to SQL injection attacks, where malicious input can be crafted to manipulate or compromise the database. Query parameterization en

Submitted by minji_kr· Mar 6, 2026Security Engineering

Question

A security architect discovers the following while reviewing code for a company's website:

selection = "SELECT Item FROM Catalog WHERE ItemID = " & Request("ItemID") Which of the following should the security architect recommend?

Options

AClient-side processing
BQuery parameterization
CData normalization
DEscape character blocking
EURL encoding

How the community answered

(27 responses)

B
89% (24)
C
7% (2)
E
4% (1)

Explanation

The code provided constructs an SQL query by directly concatenating user input (Request("ItemID")) with the query string. This approach is vulnerable to SQL injection attacks, where malicious input can be crafted to manipulate or compromise the database. Query parameterization ensures that user input is treated as a parameter rather than executable code. By using parameterized queries, the database engine automatically escapes and safely handles input, eliminating the risk of SQL injection. This is the recommended best practice to secure database interactions against such vulnerabilities.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice