What is the main reason to avoid constructing database statements dynamically from unchecked user input?

### Why this is right Unchecked input can be interpreted as part of the database command. That can change the intended query logic and allow actions such as bypassing authentication or accessing data. ### The concept Dynamic construction from untrusted values mixes data and instructions. Parameterized queries avoid this by providing values separately. Input validation is useful as an additional safeguard, but it does not make unsafe query construction a sound design. ### The other options - **B. The database will always encrypt the input**: encryption is not the mechanism that prevents query logic from changing. - **C. Dynamic statements prevent all database errors**: dynamic construction can create errors and injection weaknesses. - **D. Unchecked input automatically reduces account permissions**: permissions are set through access controls, not by the input itself. ### Terms - **Unchecked input**: data accepted without sufficient examination against expected rules. - **Parameterized query**: a query that separates supplied values from its instructions. ### Remember The key danger is that input may become part of the command.