A URL contains a user-editable value that determines the amount debited from an account. What is the key security mistake?

### Why this is right A user-controlled request parameter must not be treated as authoritative for a sensitive action. The application needs to validate the request and enforce business rules on the server side. ### The concept Parameter manipulation occurs when a user changes a value embedded in a URL or form request to alter application behavior. The material warns against trusting parameters that users can modify. Sensitive actions should be checked against the user's authorization and valid application rules. ### The other options - **The application uses a prepared statement**: this is a defense against SQL injection, not the described trust error. - **The application records an audit event**: auditing records activity and is not the parameter weakness. - **The application encrypts its session traffic**: encryption protects traffic in transit but does not make a supplied value trustworthy. ### Terms - **Parameter manipulation**: changing a user-controlled request value to alter application behavior. - **Authorization**: deciding what an authenticated identity may do. ### Remember A request value is input, not proof that the requested action is permitted.