Examkin

Question

Difficulty: EasyApplication and Software Vulnerabilities

A software developer discovers that a user feedback form concatenates untrusted input directly into a database query string, allowing arbitrary database command execution. Which of the following is the MOST effective coding practice to mitigate this vulnerability?

  1. Implement parameterized queries using prepared statementsAnswer
  2. B
    Apply HTML entity output encoding to all web server responses
  3. C
    Enforce multi-factor authentication for user login requests
  4. D
    Configure network firewall rules to block inbound database port access

Answer

Implementing parameterized queries using prepared statements is the most effective mitigation control.
Implementing parameterized queries (prepared statements) guarantees that the database engine treats user input strictly as literal data rather than executable SQL instructions. This prevents SQL injection vulnerabilities regardless of the characters supplied in the web form.

Step-by-Step Solution

1
Analyze the reported software vulnerability in the scenario
Concatenating untrusted user input directly into database queries creates a SQL injection vulnerability.
Identifying the root cause allows selection of the appropriate application-level security control.
2
Evaluate secure coding controls designed to neutralize query syntax manipulation
Prepared statements (parameterized queries) ensure input is handled purely as data rather than executable SQL code.
Pre-compiling the SQL query ensures user input cannot alter the intended database command structure.

Key Concept

SQL Injection Remediation via Parameterized Queries
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic