Multiple choice technology security

Which among the below is the correct way to safely encode the URL "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" )

  1. String safeURIToDisplay= "/admin/findUser.do?name=" + TCSSAPI.encoder().encodeForJavaScript(request.getParameter( "dangerousInput"));

  2. String safeURIToDisplay = TCSSAPI.encoder().encodeForURL( "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" ) );

  3. String safeURIToDisplay= "/admin/findUser.do?name=" + com.tcs.sapi.io.ValidationUtil.encodeForURL(request.getParameter( "dangerousInput"));

  4. None of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

When encoding user input for URLs, you must encode only the parameter value, not the entire URL string. encodeForURL applied to the whole URL (option B) would break the URL structure. encodeForJavaScript (option A) is for JavaScript context, not URLs. Option C correctly encodes only the dangerous user input portion before concatenating it with the safe URL structure.

Keep practicing — related questions