220-1102 Question 450
Single answerStructured Query Language (SQL) injectionA small business reports that its internal web-based inventory system is behaving oddly. When a technician enters a product ID into the search field, an attacker can type special characters into the URL and retrieve records that should not be visible. The developer confirms the application builds database queries by directly appending user input to SQL statements. Which action is the BEST way to prevent this type of attack?
- A
Replace dynamic SQL statements with parameterized queries or prepared statements
- B
Hide detailed database errors from users by disabling verbose error messages
- C
Block pop-up windows in the browser used to access the inventory system
- D
Require users to change their passwords every 30 days
- E
Install anti-malware software on the database server
Show answer and explanation
Correct answer: A
Explanation
This scenario describes SQL injection: an attacker enters crafted input so the application changes the meaning of a database query and returns unauthorized data. The key clue is that the application directly appends user input to SQL statements. The best mitigation is to use parameterized queries or prepared statements so input is treated strictly as data, not executable SQL. Additional best practices include input validation, least-privilege database permissions, and limiting error details shown to users. Guidance from OWASP and vendor secure coding documentation consistently identifies prepared statements as a primary defense against SQL injection.
- A. Correct.
Correct. Parameterized queries, also called prepared statements, separate user input from the SQL command structure. This prevents specially crafted input from being interpreted as part of the SQL query itself, which is a primary defense against SQL injection. This is the most effective fix because it addresses the root cause: unsafe query construction.
- B. Incorrect.
Incorrect. Suppressing verbose database errors is a good hardening step because it reduces information disclosure to attackers, but it does not stop SQL injection from occurring. An attacker may still exploit the vulnerable input even if error details are hidden.
- C. Incorrect.
Incorrect. Pop-up blocking is a browser security feature more relevant to unwanted windows or some phishing and ad-related behavior. It does not address server-side input handling or database query construction, so it does not prevent SQL injection.
- D. Incorrect.
Incorrect. Password rotation may improve account security in some environments, but it does not fix a web application vulnerability caused by unsafely concatenating user input into SQL statements. Attackers could still manipulate queries without needing stolen user passwords.
- E. Incorrect.
Incorrect. Anti-malware software can help detect malicious files or processes on a server, but SQL injection is an application-layer vulnerability. If the application accepts unsafe input and passes it directly into SQL queries, anti-malware does not resolve that coding flaw.