GWAPT · Question #106
Which of the following measures help mitigate SQL injection risks? (Choose two)
The correct answer is A. Using prepared statements with placeholders C. Validating user inputs against a whitelist. Prepared statements (A) separate SQL code from user data by using placeholders, so even malicious input is never interpreted as executable SQL. Input whitelisting (C) rejects anything that doesn't match an expected pattern, preventing dangerous characters from reaching the…
Question
Which of the following measures help mitigate SQL injection risks? (Choose two)
Options
- AUsing prepared statements with placeholders
- BHardcoding user credentials in queries
- CValidating user inputs against a whitelist
- DDisplaying verbose error messages
How the community answered
(24 responses)- A83% (20)
- B8% (2)
- D8% (2)
Explanation
Prepared statements (A) separate SQL code from user data by using placeholders, so even malicious input is never interpreted as executable SQL. Input whitelisting (C) rejects anything that doesn't match an expected pattern, preventing dangerous characters from reaching the database in the first place - together these form a defense-in-depth approach.
The distractors fail because hardcoding credentials (B) creates a completely different vulnerability (exposed secrets in source code) and does nothing to protect against injection. Verbose error messages (D) actively worsen SQL injection risk by leaking database structure and query details that attackers use to craft more precise attacks.
Memory tip: Think "PV" - Prepare it (parameterize), Validate it (whitelist). If you didn't prepare or validate, you're wide open.
Community Discussion
No community discussion yet for this question.