Rejecting every input that contains a quotation mark is always a complete defense against SQL injection.

### Why this is right The material says filtering input for quotation marks or words such as `DROP` and `INSERT` is not always possible. Such filtering is not a complete substitute for prepared statements. ### The concept Attackers may use different inputs or exploit other weaknesses in filtering logic. Prepared statements address the underlying problem by keeping parameter values separate from SQL syntax. Validation still has value for enforcing expected formats and limits. ### The other options - **The claim that quotation-mark rejection is complete**: It is false because input filtering can be incomplete and does not reliably enforce the boundary between code and data. ### Terms - **SQL injection**: Altering a database command through improperly handled input. - **Prepared statement**: A database command that separates its structure from input values. ### Remember Validate input, but use prepared statements to separate data from commands.