A database-backed application uses a prepared statement but gives its database account broad privileges and displays detailed errors. Identify two remaining risks and suitable controls.

### What a good answer covers - Broad database privileges increase the actions available to an attacker using a compromised application. - The application should receive only permissions needed for its functions. - Detailed error messages can reveal table names, field names, or other useful internal information. - User-facing error reporting should be configured to avoid that disclosure. ### The concept A prepared statement addresses SQL injection by separating command structure from parameter values, but it does not solve every application-security problem. Permission limits reduce potential impact, and careful error handling reduces information exposed during failures. Security controls address different risks and should be layered. ### Terms - **Privilege**: Permission to access or change a resource. - **Information disclosure**: Revealing details to someone who should not receive them. - **Prepared statement**: A database command separated from its parameter values. ### Remember A prepared statement prevents one class of attack; least-needed permissions and safe errors address other risks.