Select ALL defenses against application-level database attacks that are supported by the material.

### Why this is right - **Use prepared statements with bound variables.** They keep input values separate from SQL syntax. - **Limit input length and check that input has the expected syntax.** Validation can reject malformed or unreasonable input. - **Use numeric data types when a number is required.** Casting to the expected type reduces ambiguity about the value's form. - **Configure database errors so they do not reveal internal table and field details.** Detailed errors can expose information useful to an attacker. ### The concept These controls work at different layers. Prepared statements prevent input from changing command structure; validation and type checks enforce expected input; restrained error messages limit information disclosure. The material also advises against sweeping privileges. ### The other options - **D. Grant the application every database privilege to avoid access errors.**: This contradicts the instruction to avoid sweeping privileges. Excessive permissions increase the damage possible if the application is compromised. ### Terms - **Bound variable**: An input value passed separately to a prepared database command. - **Input validation**: Checking that supplied data meets expected rules. - **Privilege**: Permission to perform an action or access a resource. ### Remember Use several complementary controls, and keep database permissions limited.