CEH Web Application and Injection Attacks Practice Question
Which of the following is a primary defense against SQL injection attacks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Prepared statements
Prepared statements with parameterized queries ensure user input is treated as data, not executable SQL code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Prepared statements
Why this is correct
Prepared statements, also known as parameterized queries, are a primary defense against SQL injection because they fundamentally separate the SQL code logic from user-supplied data. The database engine pre-compiles the query structure, treating all subsequent input as literal data values rather than executable SQL commands. This mechanism ensures that malicious characters within user input cannot alter the intended query structure, effectively preventing injection attacks by ensuring input is never interpreted as code.
- ✗
HTTPS encryption
Why it's wrong here
HTTPS encryption secures data during its transmission between a client and a server, providing confidentiality, integrity, and authentication at the transport layer. While crucial for overall web security, it does not address vulnerabilities in how the server-side application processes user input once received and decrypted. SQL injection occurs at the application layer when the server constructs and executes database queries, regardless of whether the data was encrypted in transit.
- ✗
Input blacklisting
Why it's wrong here
Input blacklisting attempts to prevent SQL injection by filtering out specific known malicious characters or keywords from user input. However, this approach is inherently weak and easily bypassed by attackers who can use alternative SQL syntax, various encodings, or case manipulations to circumvent the filters. Relying on blacklists is a reactive and incomplete defense, as it's nearly impossible to anticipate and block every conceivable malicious input permutation.
- ✗
Output encoding
Why it's wrong here
Output encoding is a security measure designed to prevent Cross-Site Scripting (XSS) attacks by transforming user-supplied data into a safe representation before it is rendered in a web browser. This process ensures that malicious scripts embedded in data are displayed as text rather than executed by the browser. While essential for preventing client-side vulnerabilities like XSS, output encoding does not protect against SQL injection, which exploits server-side flaws in database query construction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.