What is the primary defense against SQL injection described in the material?
Answer
Prepared statements with bound parameters
Explanation
### Why this is right
Prepared statements separate the SQL command structure from parameter values. Bound input is treated as data, so it cannot change the command's intended structure in the same way as concatenated input.
### The concept
SQL injection occurs when user input is interpreted as part of a database command. Validation and type checks are useful additional controls, but filtering selected characters is not a reliable replacement for parameterization.
### The other options
- **Filtering a few selected punctuation characters**: incomplete filtering can be bypassed and does not separate code from data.
- **Displaying detailed database errors**: can expose sensitive implementation details.
- **Giving the application administrator privileges**: increases the possible damage of a successful injection.
### Terms
- **SQL injection**: causing user input to alter a database command.
- **Prepared statement**: a database command whose structure is separated from supplied values.
### Remember
Bind values as data instead of building commands by joining user input.
Related Questions
- Explain why computer security is described as a process rather than a product. Include the roles of technology, people, and environment.(intermediate)
- Select ALL items the review identifies as possible security risks or losses.(intermediate)
- Arrange these broad security activities in a sensible cycle, beginning with identifying what needs protection.(intermediate)
- A security product can replace the continuing work of managing people, technology, and the operating environment.(intermediate)
- Which statement best captures the course review’s view of computer security?(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free