Multiple choice technology security

Which among the below is the correct way to safely encode the URL "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" )

  1. String safeURIToDisplay= "/admin/findUser.do?name=" + TCSSAPI.encoder().encodeForJavaScript(request.getParameter( "dangerousInput"));

  2. String safeURIToDisplay = TCSSAPI.encoder().encodeForURL( "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" ) );

  3. String safeURIToDisplay= "/admin/findUser.do?name=" + com.tcs.sapi.io.ValidationUtil.encodeForURL(request.getParameter( "dangerousInput"));

  4. None of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Only the user-supplied parameter needs encoding, not the entire URL structure. Option C correctly encodes just the dangerous input while preserving the URL's query parameter syntax. Option A uses JavaScript encoding which is inappropriate for URL contexts, and Option B incorrectly encodes the entire URL string including the '=' delimiter.

Keep practicing — related questions