Examkin

Soru

Zorluk: KolayApplication and Software Vulnerabilities

A software developer discovers that a user feedback form concatenates untrusted input directly into a database query string, allowing arbitrary database command execution. Which of the following is the MOST effective coding practice to mitigate this vulnerability?

  1. Implement parameterized queries using prepared statementsCevap
  2. B
    Apply HTML entity output encoding to all web server responses
  3. C
    Enforce multi-factor authentication for user login requests
  4. D
    Configure network firewall rules to block inbound database port access

Cevap

Implementing parameterized queries using prepared statements is the most effective mitigation control.
Implementing parameterized queries (prepared statements) guarantees that the database engine treats user input strictly as literal data rather than executable SQL instructions. This prevents SQL injection vulnerabilities regardless of the characters supplied in the web form.

Adım Adım Çözüm

1
Analyze the reported software vulnerability in the scenario
Concatenating untrusted user input directly into database queries creates a SQL injection vulnerability.
Identifying the root cause allows selection of the appropriate application-level security control.
2
Evaluate secure coding controls designed to neutralize query syntax manipulation
Prepared statements (parameterized queries) ensure input is handled purely as data rather than executable SQL code.
Pre-compiling the SQL query ensures user input cannot alter the intended database command structure.

Anahtar Kavram

SQL Injection Remediation via Parameterized Queries
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru