Multiple choice technology security

What is the best methodology to remediate the SQL Injection vulnerability in a Java based web application?

  1. Use the com.tcs.sapi.io.ValidationUtil.encodeForOraSQL(String input) method

  2. Use PreparedStatement constructs and use the setXXX methods on the PreparedStatement object

  3. Use the Java createStatement construct to execute the query

  4. Concatenate your SQL string together using dynamic input and create and execute a PreparedStatement object using that query
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

PreparedStatement with setXXX methods is the strongest defense because it separates SQL logic from data, treating user input as parameters rather than concatenating it into the query string. This completely eliminates SQL injection at the database driver level. Encoding methods (option A) are fragile workarounds - if you forget to encode even once, you're vulnerable. createStatement with concatenated strings (option C/D) is exactly what causes SQL injection vulnerabilities.

Keep practicing — related questions