Which of the following BEST describes a protective countermeasure for SQL injection?

The correct answer is C. Validating user input in web applications. SQL injection occurs when an attacker inserts malicious SQL code into an input field that is then executed by the database. The most direct and effective countermeasure is input validation - sanitizing and rejecting unexpected or malicious characters before they reach the…

Threats, vulnerabilities, and mitigations

Question

Options

AEliminating cross-site scripting vulnerabilities
BInstalling an IDS to monitor network traffic
CValidating user input in web applications
DPlacing a firewall between the Internet and database servers

How the community answered

(29 responses)

A
14% (4)
B
3% (1)
C
79% (23)
D
3% (1)

Explanation

SQL injection occurs when an attacker inserts malicious SQL code into an input field that is then executed by the database. The most direct and effective countermeasure is input validation - sanitizing and rejecting unexpected or malicious characters before they reach the database query. Techniques include parameterized queries (prepared statements) and whitelisting acceptable input. Eliminating XSS vulnerabilities (A) addresses a different attack class. An IDS (B) can detect but not prevent SQL injection. A firewall (D) operates at the network layer and cannot inspect application-layer SQL payloads embedded in legitimate HTTP traffic.

Topics

#SQL injection#input validation#web application security#injection attacks

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice