Multiple choice technology security

What is the best methodology to remediate the SQL Injection vulnerability in a Java based web application?

  1. Use the com.tcs.sapi.io.ValidationUtil.encodeForOraSQL(String input) method

  2. Use PreparedStatement constructs and use the setXXX methods on the PreparedStatement object

  3. Use the Java createStatement construct to execute the query

  4. Concatenate your SQL string together using dynamic input and create and execute a PreparedStatement object using that query
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

PreparedStatement with parameterized queries using setXXX methods is the industry standard for preventing SQL injection. It separates SQL logic from data, ensuring user input is never interpreted as SQL commands. String encoding approaches are secondary defenses, not the primary best-practice methodology.

Keep practicing — related questions