A penetration tester was able to enter an SQL injection command into a text box and gain access to the information store on the database. Which of the following is the BEST recommendation that would…

Randomizing login credentials limits credential reuse attacks but does not prevent an attacker from submitting malicious SQL through the vulnerable input field.

A host-based intrusion detection system can generate alerts on suspicious query patterns but does not sanitize input or enforce parameterized queries to stop the injection itself.

Input normalization standardizes encoding formats such as Unicode but does not separate SQL code from user-supplied data, which is what parameterized queries accomplish to prevent injection.

System hardening encompasses enforcing parameterized queries, applying the principle of least privilege to database accounts, disabling dangerous built-in stored procedures, and patching the underlying OS and database engine - all of which collectively eliminate the conditions that make SQL injection exploitation possible. This multi-layer approach reduces both the probability of a successful injection and the potential damage if one occurs. It is more comprehensive than any single control because it hardens the application, database, and host simultaneously.