CISSP Software Development Security Practice Question
Which of the following is a secure coding practice to prevent SQL injection attacks?
⚠ Common exam trap
Many candidates confuse 'stored procedures' with being inherently secure, but the CISSP exam tests that stored procedures can still be vulnerable if they use dynamic SQL with concatenated input, whereas parameterized queries (or prepared statements) are the definitive defense.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using parameterized queries
Parameterized queries (also known as prepared statements) separate SQL code from data by using placeholders (e.g., '?' in ODBC/JDBC or ':param' in Oracle) that are bound to user-supplied values at execution time. This ensures that input is always treated as data, never as executable SQL syntax, effectively neutralizing SQL injection regardless of the input content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escaping all user input
Why it's wrong here
Escaping all user input attempts to neutralize malicious characters by adding escape sequences, preventing them from being interpreted as SQL commands. However, this method is highly error-prone due to the complexity of different database systems' escaping rules and character encodings. A single missed character or incorrect escaping context can still lead to a successful SQL injection, making it an unreliable defense compared to more robust techniques.
- ✓
Using parameterized queries
Why this is correct
Parameterized queries, also known as prepared statements, are a highly effective secure coding practice for preventing SQL injection. They work by defining the SQL query structure with placeholders for data, which are then passed separately to the database engine. This strict separation ensures that user-supplied input is always treated as data values, never as executable SQL code, thus neutralizing any embedded malicious commands.
- ✗
Using stored procedures exclusively
Why it's wrong here
While stored procedures can offer some security benefits by encapsulating database logic and permissions, their exclusive use does not inherently prevent SQL injection. If a stored procedure constructs SQL statements dynamically using concatenated user input, it remains vulnerable to injection attacks. The security depends entirely on how the dynamic SQL within the procedure handles input, requiring the same careful parameterization as any other application-generated query.
- ✗
Validating input length
Why it's wrong here
Validating input length is a basic form of input validation that helps prevent buffer overflows or excessively long data entries, but it offers no protection against SQL injection. An attacker can craft a perfectly valid, short SQL injection payload that fits within typical length constraints. The malicious nature of an SQL injection lies in the content and syntax of the input, not merely its length, making this control ineffective for preventing such attacks.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.