You have a database in an Azure Cosmos DB for NoSQL account. You need to create an Azure function that will access the database to retrieve records based on a variable named accountnumber. The…

The correct answer is C. cmd = "SELECT * FROM Persons p. Azure Cosmos DB supports queries with parameters expressed by the familiar @ notation. Parameterized SQL provides robust handling and escaping of user input, and prevents accidental exposure of data through SQL injection. For example, you can write a query that takes lastName…

Integrate an Azure Cosmos DB solution

Question

You have a database in an Azure Cosmos DB for NoSQL account. You need to create an Azure function that will access the database to retrieve records based on a variable named accountnumber. The solution must protect against SQL injection attacks. How should you define the command statement in the function?

Options

Acmd = "SELECT * FROM Persons p
Bcmd = "SELECT * FROM Persons p
Ccmd = "SELECT * FROM Persons p
Dcmd = "SELECT * FROM Persons p

How the community answered

(62 responses)

B
3% (2)
C
95% (59)
D
2% (1)

Explanation

Azure Cosmos DB supports queries with parameters expressed by the familiar @ notation. Parameterized SQL provides robust handling and escaping of user input, and prevents accidental exposure of data through SQL injection. For example, you can write a query that takes lastName and address.state as parameters, and execute it for various values of lastName and address.state based on user input. WHERE f.lastName = @lastName AND f.address.state = @addressState

Topics

#SQL Injection#Parameterized Queries#Azure Cosmos DB NoSQL#Secure Coding

Community Discussion

No community discussion yet for this question.

Full DP-420 Practice