Multiple choice technology security

What is the best methodology to remediate the SQL Injection vulnerability in a Java based web application?

  1. Use the com.tcs.sapi.io.ValidationUtil.encodeForOraSQL(String input) method

  2. Use PreparedStatement constructs and use the setXXX methods on the PreparedStatement object

  3. Use the Java createStatement construct to execute the query

  4. Concatenate your SQL string together using dynamic input and create and execute a PreparedStatement object using that query
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

PreparedStatement with parameterized queries is the best practice - it completely separates SQL logic from data, preventing injection. createStatement with dynamic concatenation (C and D) is vulnerable. encodeForOraSQL is a workaround but not the primary methodology.

Keep practicing — related questions