312-50 Question 368
Select 2▪ SQL Injection CountermeasuresA company asks you to review a customer portal after a penetration test found SQL injection in the login and search functions. The development team proposes several fixes before the next release. As the security consultant, which TWO actions would provide the most effective countermeasure against SQL injection while preserving application functionality?
- A
Replace dynamic SQL string concatenation with parameterized queries or prepared statements in all database calls
- B
Escape single quotes in user input and rely on client-side JavaScript validation to block malicious characters
- C
Implement server-side allowlist validation for expected input formats and lengths before sending data to the database
- D
Hide detailed database error messages from users, but leave the existing query-building logic unchanged
- E
Grant the web application database account DBA-level privileges so it can safely handle unexpected queries
Show answer and explanation
Correct answers: A, C
Explanation
The best answer is to combine parameterized queries/prepared statements with strong server-side allowlist validation. In real environments, the most effective SQL injection countermeasure is to eliminate unsafe query construction by binding parameters instead of concatenating user input into SQL statements. Input validation adds defense in depth by rejecting data that does not match business expectations before it reaches database code. By contrast, client-side validation is bypassable, quote escaping is error-prone as a primary control, and hiding database errors only reduces attacker feedback without fixing the underlying flaw. Least privilege is also a key best practice: the application's database account should have only the minimum permissions needed. These recommendations align with widely accepted guidance such as the OWASP SQL Injection Prevention Cheat Sheet, which prioritizes prepared statements, properly designed stored procedures when implemented safely, allowlist input validation, and least-privilege database access.
- A. Correct.
Correct. Parameterized queries, also called prepared statements, separate SQL code from user-supplied data. This is one of the primary and most reliable defenses against SQL injection because the database treats input as data rather than executable SQL. This directly addresses the root cause in both login and search functions.
- B. Incorrect.
Incorrect. Escaping single quotes alone is not a sufficient or reliable primary defense, especially across different database engines, encodings, and query contexts. Client-side JavaScript validation can be bypassed easily by an attacker using a proxy or custom request. This option reflects a common misconception that filtering characters in the browser is enough.
- C. Correct.
Correct. Server-side allowlist validation helps ensure inputs conform to expected formats, such as numeric IDs, limited search strings, or email-style usernames. While validation is not a substitute for parameterized queries, it is an important defense-in-depth control that reduces attack surface and prevents malformed input from reaching database logic.
- D. Incorrect.
Incorrect. Suppressing verbose error messages is useful because it limits information disclosure to attackers, but it does not prevent SQL injection if the application still builds queries through unsafe string concatenation. This is a mitigation for reconnaissance, not a fix for the vulnerability itself.
- E. Incorrect.
Incorrect. Granting DBA-level privileges increases the impact of a successful SQL injection attack. Best practice is to use least privilege so the application account has only the permissions required for its functions. Excessive privileges turn a code flaw into a much more severe compromise.