Which practice best mitigates SQL injection attacks?

• A. Input validation and parameterized queries
• B. Firewall blocking all ports
• C. Disable logging
• D. Use of steganography

Answer: (A)

Preventing SQL injection starts by making sure user input is treated strictly as data, not as part of the SQL code. The most effective way to achieve this is using input validation to enforce acceptable formats and, more importantly, parameterized (prepared) queries. Parameterized queries separate the SQL code from the data being supplied, so any user input is bound as a value rather than executable code. This defense stops attempts to alter the query structure with injected SQL because the database treats the input as data only, no matter what characters are supplied. Input validation adds another layer by rejecting inputs that don’t meet expected patterns, lengths, or types.

Other options don’t address how the application builds and executes database queries. A firewall blocks network access but can’t prevent harmful data from reaching the application or stop it from being used to modify a query once inside the app. Disabling logging removes visibility into potential attacks and doesn’t fix the vulnerability. Steganography has no relation to database security or SQL query handling.