CEH Web Application and Injection Attacks Practice Question
Which of the following is the most effective defense against SQL injection attacks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Parameterized queries
Parameterized queries (prepared statements) ensure user input is treated as data, not executable code, preventing SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Parameterized queries
Why this is correct
Parameterized queries, also known as prepared statements, are the most effective defense because they fundamentally separate SQL code from user-supplied data. The database engine pre-compiles the SQL query structure, treating all subsequent user input as literal data values, not executable code. This prevents malicious input from altering the query's intent, making SQL injection attacks virtually impossible against properly implemented parameterized queries.
- ✗
Escaping all user input
Why it's wrong here
Escaping all user input is an error-prone and less reliable defense against SQL injection compared to parameterization. Developers must meticulously identify and escape every special character relevant to the specific database context and character set, a task easily prone to oversight or incorrect implementation. A single missed escape sequence or an assumption about character encoding can create a critical vulnerability, making it an inferior and fragile solution.
- ✗
Input validation using blacklists
Why it's wrong here
Input validation using blacklists is inherently weak because it attempts to block known bad inputs rather than permitting only known good ones. Attackers can often bypass blacklists by employing various encoding schemes, alternative SQL syntax, or simply finding a character or keyword not included in the blacklist. This reactive approach is unsustainable and frequently leads to vulnerabilities as new bypass techniques are discovered.
- ✗
Stored procedures
Why it's wrong here
While stored procedures can contribute to security by encapsulating database logic, they are not a standalone defense against SQL injection. If a stored procedure constructs dynamic SQL strings by concatenating user input without proper parameterization, it remains fully vulnerable to injection attacks. Their security depends entirely on how the SQL within them is written and whether parameterized queries are consistently employed for all user-supplied data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a primary defense against SQL injection attacks?
easy- ✓ A.Prepared statements
- B.HTTPS encryption
- C.Input blacklisting
- D.Output encoding
Why A: Prepared statements with parameterized queries ensure user input is treated as data, not executable SQL code.
Variation 2. Which TWO of the following are effective defenses against SQL injection attacks?
medium- A.Implementing stored procedures with dynamic SQL
- B.Disabling error messages
- ✓ C.Using an ORM that generates parameterized queries
- ✓ D.Using prepared statements with parameterized queries
- E.Escaping user input with addslashes()
Why C: Prepared statements (parameterized queries) and stored procedures (if properly parameterized) prevent SQL injection by separating data from code.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.