A web developer wants to ensure that malicious users can't type SQL statements when they asked for input, like their username/userid. Which of the following query optimization techniques would…

The correct answer is D. Parametrization. Parameterization (also called parameterized queries or prepared statements) prevents SQL injection by separating SQL code from user-supplied data. The query structure is defined first with placeholders, and user input is passed as parameters - the database engine then treats…

Data Governance, Quality, and Controls

Question

A web developer wants to ensure that malicious users can't type SQL statements when they asked for input, like their username/userid. Which of the following query optimization techniques would effectively prevent SQL Injection attacks?

Options

AIndexing.
BSubset of records.
CTemporary table in the query set.
DParametrization.

How the community answered

(40 responses)

A
5% (2)
B
5% (2)
C
3% (1)
D
88% (35)

Explanation

Parameterization (also called parameterized queries or prepared statements) prevents SQL injection by separating SQL code from user-supplied data. The query structure is defined first with placeholders, and user input is passed as parameters - the database engine then treats the input strictly as data, never as executable SQL. This makes it impossible for a malicious user to inject commands. Indexing (A) improves query performance but has no security benefit. Subset of records (B) limits returned data but does not prevent injection. Temporary tables (C) are a performance/organization technique with no injection protection.

Topics

#SQL Injection#Database Security#Parametrization#Secure Coding

Community Discussion

No community discussion yet for this question.

Full DA0-001 Practice