What is SQL injection, and which defense is most effective?

What is SQL injection, and which defense is most effective?

• A. A method to optimize SQL queries; defense: proper indexing.
• B. A type of data deletion; defense: regular backups.
• C. A server misconfiguration; defense: firewall alone.
• D. Inserting malicious SQL via user input; defense: use parameterized queries/prepared statements.

Answer: (D)

Understanding SQL injection and its defense: SQL injection happens when user-supplied input is incorporated into an SQL statement in an unsafe way, allowing an attacker to alter the query’s structure. This can lead to unauthorized data access, data tampering, or even dropping tables. The most effective defense is using parameterized queries or prepared statements. With this approach, the SQL code is defined first with placeholders for data, and all user input is bound as data, not as part of the SQL command. That separation prevents any injected input from changing the intended query logic, so even malicious input cannot alter what the query does. This defense remains robust across languages and databases because it consistently treats input as data, not executable code. Why the other options aren’t the right fit here: optimizing queries with proper indexing improves performance, not security. Regular backups protect against data loss but don’t stop an attacker from manipulating or reading data through an injection vulnerability. A firewall helps with network security, but SQL injection targets how the application builds queries, not just network boundaries, so a firewall alone can’t reliably block this threat.

Understanding SQL injection and its defense: SQL injection happens when user-supplied input is incorporated into an SQL statement in an unsafe way, allowing an attacker to alter the query’s structure. This can lead to unauthorized data access, data tampering, or even dropping tables. The most effective defense is using parameterized queries or prepared statements. With this approach, the SQL code is defined first with placeholders for data, and all user input is bound as data, not as part of the SQL command. That separation prevents any injected input from changing the intended query logic, so even malicious input cannot alter what the query does. This defense remains robust across languages and databases because it consistently treats input as data, not executable code.

Why the other options aren’t the right fit here: optimizing queries with proper indexing improves performance, not security. Regular backups protect against data loss but don’t stop an attacker from manipulating or reading data through an injection vulnerability. A firewall helps with network security, but SQL injection targets how the application builds queries, not just network boundaries, so a firewall alone can’t reliably block this threat.