hardMultiple ChoiceObjective-mapped
Most Effective Remediation for SQL Injection in Java Web Applications
During a code review, a developer encounters the following code snippet in a Java web application used to authenticate users:
String query = "SELECT * FROM users WHERE username = '" + request.getParameter("user") + "' AND password = '" + request.getParameter("pass") + "'";
Which of the following is the MOST effective remediation?
Quick Answer
The correct answer is to replace the concatenated query with a prepared statement and bind parameters, as this is the most effective remediation for SQL injection in Java web applications. This approach works because prepared statements, or parameterized queries, strictly separate SQL logic from user-supplied data; by using bind variables like `ps.setString(1, user)`, the database engine treats the input as data only, never as executable code, thereby neutralizing injection attempts entirely. On the CISSP exam, this concept tests your understanding of secure coding practices within the Software Development Security domain, often appearing as a trap where developers mistakenly rely on input validation or escaping instead of parameterization. A common memory tip is to remember that prepared statements “prepare the plan first, then plug in the data”—if the SQL structure is fixed before any user input touches it, injection is impossible.
⚠ Common exam trap
Watch out — candidates often choose input validation (Option A) or escaping (Option C) because they seem like reasonable security measures, but the CISSP exam emphasizes that parameterized queries/prepared statements are the definitive, defense-in-depth solution for SQL injection, not ad-hoc sanitization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the concatenated query with a prepared statement and bind parameters
Prepared statements with parameterized queries separate SQL logic from user input, preventing SQL injection entirely. In Java, using PreparedStatement with bind variables (e.g., `ps.setString(1, user)`) ensures the database treats input as data, not executable code, which is the only reliable defense against SQL injection attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use regular expressions to validate the username and password inputs
Why it's wrong here
Input validation alone is not sufficient; SQL injection can still occur through encoding bypasses.
- ✗
Encode the input using HTML entity encoding before inclusion in the query
Why it's wrong here
HTML encoding is for XSS, not SQL injection; it does not prevent SQL injection.
- ✗
Escape single quotes in the input parameters
Why it's wrong here
Escaping is error-prone and may be bypassed; prepared statements are the recommended defense.
- ✓
Replace the concatenated query with a prepared statement and bind parameters
Why this is correct
Prepared statements ensure user input is treated as data, not executable SQL.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. Which vulnerability does this code contain?
easy- ✓ A.SQL injection
- B.Command injection
- C.Buffer overflow
- D.Cross-site scripting (XSS)
Why A: The question refers to an exhibit that is missing. To make the question complete and self-contained, we should embed the vulnerable code snippet directly into the stem.
Variation 2. During a code review, a developer identifies a SQL injection vulnerability. What is the most effective fix?
easy- A.Use stored procedures exclusively.
- B.Use an ORM framework.
- C.Escape all input.
- ✓ D.Implement parameterized queries.
Why D: Parameterized queries (prepared statements) ensure user input is treated as data, not executable code. Stored procedures can still be vulnerable if dynamically built. Escaping input is error-prone. ORMs often use SQL underneath and may not prevent injection if misused.
Variation 3. Which TWO of the following are mandatory secure coding practices to prevent injection attacks? (Select exactly two.)
medium- A.Encode output to the browser
- B.Encrypt sensitive input data
- C.Use custom error messages that detail the failure
- ✓ D.Use parameterized queries or prepared statements
- ✓ E.Validate and sanitize all user input
Why D: Parameterized queries (prepared statements) separate SQL logic from data, ensuring user input is always treated as a literal value rather than executable code. This prevents attackers from injecting malicious SQL fragments because the database engine compiles the query structure before any user-supplied data is bound to placeholders.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.