hardMultiple Choice
Most Effective Remediation for SQL Injection in Java Web Applications
During a code review, a developer encounters the following code snippet in a Java web application used to authenticate users:
String query = "SELECT * FROM users WHERE username = '" + request.getParameter("user") + "' AND password = '" + request.getParameter("pass") + "'";
Which of the following is the MOST effective remediation?
Quick Answer
The correct answer is to replace the concatenated query with a prepared statement and bind parameters, as this is the most effective remediation for SQL injection in Java web applications. This approach works because prepared statements, or parameterized queries, strictly separate SQL logic from user-supplied data; by using bind variables like `ps.setString(1, user)`, the database engine treats the input as data only, never as executable code, thereby neutralizing injection attempts entirely. On the CISSP exam, this concept tests your understanding of secure coding practices within the Software Development Security domain, often appearing as a trap where developers mistakenly rely on input validation or escaping instead of parameterization. A common memory tip is to remember that prepared statements “prepare the plan first, then plug in the data”—if the SQL structure is fixed before any user input touches it, injection is impossible.
⚠ Common exam trap
Watch out — candidates often choose input validation (Option A) or escaping (Option C) because they seem like reasonable security measures, but the CISSP exam emphasizes that parameterized queries/prepared statements are the definitive, defense-in-depth solution for SQL injection, not ad-hoc sanitization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the concatenated query with a prepared statement and bind parameters
Prepared statements with parameterized queries separate SQL logic from user input, preventing SQL injection entirely. In Java, using PreparedStatement with bind variables (e.g., `ps.setString(1, user)`) ensures the database treats input as data, not executable code, which is the only reliable defense against SQL injection attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use regular expressions to validate the username and password inputs
Why it's wrong here
Input validation alone is not sufficient; SQL injection can still occur through encoding bypasses.
- ✗
Encode the input using HTML entity encoding before inclusion in the query
Why it's wrong here
HTML entity encoding targets browser-side XSS, not SQL parsing, so injected characters remain meaningful to the database. It is tempting because output encoding is a genuine control for reflected content, but the correct layer here is parameterised queries, which stop the database treating input as executable SQL.
- ✗
Escape single quotes in the input parameters
Why it's wrong here
Escaping single quotes only blocks quote-based injection; numeric, comment-based and encoded payloads still pass, and escaping is easily misapplied. It is tempting because escaping is a legitimate defence-in-depth measure, but parameterised queries (prepared statements) separate SQL code from data and are the effective remediation here.
- ✓
Replace the concatenated query with a prepared statement and bind parameters
Why this is correct
String concatenation lets attacker-supplied input alter query structure, enabling SQL injection and authentication bypass. A prepared statement with bound parameters sends the query template separately from data, so input is treated strictly as a value and cannot change the SQL grammar.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. Which vulnerability does this code contain?
easy- ✓ A.SQL injection
- B.Command injection
- C.Buffer overflow
- D.Cross-site scripting (XSS)
Why A: The question refers to an exhibit that is missing. To make the question complete and self-contained, we should embed the vulnerable code snippet directly into the stem.
Variation 2. During a code review, a developer identifies a SQL injection vulnerability. What is the most effective fix?
easy- A.Use stored procedures exclusively.
- B.Use an ORM framework.
- C.Escape all input.
- ✓ D.Implement parameterized queries.
Why D: Parameterized queries (prepared statements) ensure user input is treated as data, not executable code. Stored procedures can still be vulnerable if dynamically built. Escaping input is error-prone. ORMs often use SQL underneath and may not prevent injection if misused.
Variation 3. Which TWO of the following are mandatory secure coding practices to prevent injection attacks? (Select exactly two.)
medium- A.Encode output to the browser
- B.Encrypt sensitive input data
- C.Use custom error messages that detail the failure
- ✓ D.Use parameterized queries or prepared statements
- ✓ E.Validate and sanitize all user input
Why D: Option D is correct because parameterized queries or prepared statements ensure that user-supplied data is treated strictly as data, not executable code, which structurally prevents SQL injection and similar injection flaws by separating the query logic from the input values. Option E is correct because validating and sanitizing all user input enforces allow-list or expected-format checks and strips or neutralizes dangerous characters, reducing the attack surface for injection vectors such as SQL, command, and LDAP injection. Option A is not mandatory for preventing injection itself; output encoding primarily mitigates cross-site scripting (XSS) by rendering data inert in the browser context, which is a different vulnerability class. Option B is incorrect because encrypting sensitive input data protects confidentiality in transit or at rest but does nothing to stop malicious payloads from being interpreted as code by an interpreter. Option C is incorrect because detailed custom error messages can leak schema, stack traces, or query structure to attackers, aiding injection exploitation rather than preventing it; generic error handling is the safer practice.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.