Multiple choice technology testing

Select the one which would lead to SQL injection attack

  1. SqlDataAdapter myCommand = new SqlDataAdapter( "SELECT CustomerName, Email, PhoneNo FROM users WHERE cust_id = '" + txtuser.Text + "'", myConnection);

  2. CREATE PROCEDURE procGetUser @custId VARCHAR(5) AS SELECT CustomerName, Email, PhoneNo FROM Customers WHERE cust_id = @custId

  3. SqlDataAdapter myDataAdapter = new SqlDataAdapter("SELECT CustomerName, Email, PhoneNo FROM Customers WHERE cust_id = @cust_id", connection); myCommand.SelectCommand.Parameters.Add("@cust_id", SqlDbType.VarChar,

  4. All the above
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

String concatenation with user input (A) allows attackers to inject malicious SQL by crafting input like ' OR 1=1--. Options B and C use parameterized queries, which separate SQL code from data, making injection impossible.

Keep practicing — related questions