How should an application prevent SQL injection?

Question

Accepted Answer

Use parameterized queries with bind variables — never building SQL by string concatenation — Bind variables keep input as data so it cannot alter query structure (CWE-89) — manual escaping is incomplete and bypassable, keyword-stripping breaks valid input and misses encodings, and read-only rights limit impact but do not stop injection or data theft.

Answer

Escape quotes and special characters in the input — before concatenating it into the SQL

Answer

Strip SQL keywords such as SELECT and DROP — out of every value that the user submits

Answer

Run the database account with read-only rights — so injected queries cannot modify data

How should an application prevent SQL injection?

Why this is the answer

More Secure Coding flashcards