CEH Web Application and Injection Attacks Practice Question
Which TWO of the following are commonly used to mitigate SQL injection vulnerabilities? (Select 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stored procedures
Parameterized queries and stored procedures (when used correctly) prevent SQL injection by separating SQL logic from data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Stored procedures
Why this is correct
Stored procedures, when implemented with parameterized inputs, offer a robust defense against SQL injection. By pre-compiling the SQL statements on the database server, they ensure that user-supplied data is treated strictly as data values, not executable code. This separation prevents malicious input from altering the intended query logic, effectively neutralizing injection attempts before execution.
- ✗
Output encoding
Why it's wrong here
Output encoding is a crucial security measure designed to prevent Cross-Site Scripting (XSS) attacks by converting special characters in user-supplied data into their entity equivalents before rendering them in a web browser. This process ensures that the browser interprets the data as text rather than executable script. However, output encoding does not mitigate SQL injection, as SQLi occurs at the database query construction stage, long before data is presented to a user's browser.
- ✗
Input validation
Why it's wrong here
Input validation involves checking, sanitizing, and filtering user-supplied data to ensure it conforms to expected formats, types, and lengths before processing. While a vital component of overall application security, it serves as a secondary defense against SQL injection because it can be complex to implement perfectly and may be bypassed by sophisticated attackers. It is not a foolproof primary mitigation, as it relies on anticipating all possible malicious inputs rather than fundamentally separating code from data.
- ✓
Parameterized queries
Why this is correct
Parameterized queries, also known as prepared statements, are the most effective and primary defense against SQL injection attacks. They work by defining the SQL query structure separately from the actual user-supplied data, using placeholders for input values. The database then treats all input as literal data, preventing any malicious characters from being interpreted as executable SQL commands, thereby eliminating the injection vulnerability.
- ✗
HTTPS encryption
Why it's wrong here
HTTPS encryption secures data in transit between a client and a server, protecting against eavesdropping and tampering by encrypting the communication channel. While essential for data confidentiality and integrity over the network, it does not prevent SQL injection attacks. SQL injection vulnerabilities arise from insecure application code that constructs database queries, a flaw that occurs at the application layer *after* the data has been decrypted and processed by the web server, regardless of the transport security.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.