200-901 Application Deployment and Security Practice Question

A web application is vulnerable to SQL injection. Which secure coding practice should the developer implement in the code to prevent this?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use parameterised queries for database access.

Using parameterised queries (prepared statements) ensures that user input is treated as data, not executable SQL code, preventing SQL injection.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use parameterised queries for database access.
Why this is correct
Parameterised queries send SQL code and user-supplied values to the database as separate constructs, so input is bound as data rather than parsed as executable SQL. This neutralises injection payloads by removing the mechanism attackers rely on, directly satisfying the requirement to prevent SQL injection within the application code.
✗
Escape all user input with htmlspecialchars.
Why it's wrong here
htmlspecialchars encodes HTML metacharacters for XSS defence, not SQL syntax; it leaves quotes and SQL operators intact, so injection through the query string still succeeds. Parameterised queries with bound parameters are required. Output encoding is tempting because it is the correct fix for reflected or stored cross-site scripting.
✗
Use a CAPTCHA on the login form.
Why it's wrong here
A CAPTCHA throttles automated abuse at the form, but the injection flaw persists because the query still concatenates unsanitised input; parameterised queries or prepared statements are needed to separate code from data. CAPTCHAs are tempting as bot and credential-stuffing defences, where they are the right control.

Go deeper