Which control most directly prevents user input from changing the structure of a Structured Query Language (SQL) statement?

### Why this is right Parameterized queries keep the statement's instructions separate from the values supplied by a user. The database treats input as data, so text intended as a command cannot change the query structure. ### The concept A parameterized query uses placeholders for values and supplies those values separately. Input validation can reject unexpected values, while a WAF filters requests, but neither is a substitute for separating code from data. Least privilege limits the harm if another weakness is exploited. ### The other options - **B. A Web Application Firewall (WAF) alone**: a WAF may block suspicious requests, but filtering can miss attacks and does not fix unsafe query construction. - **C. Detailed error messages shown to every user**: errors can expose implementation details; they do not prevent injection. - **D. A highly privileged database account**: excessive permissions increase potential damage rather than prevent the vulnerability. ### Terms - **SQL**: Structured Query Language, used to define and query relational databases. - **Parameterized query**: a database query that supplies input values separately from its instructions. - **WAF**: Web Application Firewall, a filter that examines web traffic for suspicious requests. ### Remember Separate query instructions from user-supplied values.