Multiple choice technology security

"SELECT name FROM users WHERE id = " + form.getUserID()"; Using TCS SAPI what is the best way to remediate the SQL injection vulnerability in the above query to an Oracle Database?

  1. "SELECT name FROM users WHERE id = " + com.tcs.sapi.io.ValidationUtil.encodeForOraSQL(validatedUserId);

  2. "SELECT name FROM users WHERE id = " + com.tcs.sapi.io.ValidationUtil.encodeForSQL(validatedUserId);

  3. "SELECT name FROM users WHERE id = " + com.tcs.sapi.io.ValidationUtil.encodeForSQL( new Codec(), validatedUserId);

  4. None of the above
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

For Oracle databases, TCS SAPI provides the encodeForOraSQL method which handles Oracle-specific SQL injection concerns including handling of Oracle's particular SQL syntax and escaping rules. Generic SQL encoding methods may not account for Oracle's specific injection vulnerabilities.

Keep practicing — related questions