Keeping query input separate from executable query structure
A fictional application accepts a customer-supplied search term and uses it in a database query. Which design most directly reduces SQL-injection risk?
A
Hide the database vendor’s name while leaving input concatenation unchanged.
B
Validate input only in the browser and trust direct requests to the server.
C
Use parameterized queries so the supplied term is handled as data rather than executable query structure.
D
Concatenate the raw term into executable SQL and rely on users to behave.
Question Leaderboard
Not enough data yet to show leaderboard.