Multiple choice technology security

What is the best methodology to remediate the SQL Injection vulnerability in a Java based web application?

  1. Use the com.tcs.sapi.io.ValidationUtil.encodeForOraSQL(String input) method

  2. Use PreparedStatement constructs and use the setXXX methods on the PreparedStatement object

  3. Use the Java createStatement construct to execute the query

  4. Concatenate your SQL string together using dynamic input and create and execute a PreparedStatement object using that query
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

PreparedStatement with parameterized queries is the gold standard for preventing SQL injection because it separates SQL logic from data. Options A and C rely on encoding or string concatenation which are less reliable. Option D is dangerous because it concatenates input before using PreparedStatement, negating its benefits.

Keep practicing — related questions