Which practice helps prevent SQL Injection?

• A. Concatenating user input into SQL queries.
• B. Using parameterized queries or prepared statements.
• C. Storing passwords in plaintext.
• D. Disabling database logging.

Answer: (B)

Preventing SQL injection hinges on treating user input as data, not as part of the SQL command. When input is embedded directly into a query through string concatenation, an attacker can craft input that changes the meaning of the query and access or manipulate data.

Using parameterized queries or prepared statements solves this by separating the SQL code from the data. The query is written with placeholders, and the user-supplied values are supplied separately as parameters. The database driver binds these parameters in a way that ensures they are treated strictly as data, so any special characters cannot alter the query’s structure.

For example, instead of building a query by concatenating strings with user input, you define a statement with placeholders and pass the actual values separately. The DB treats the values as data only, not as executable code, which blocks injection attempts.

Storing passwords in plaintext and disabling database logging address other concerns and do not prevent SQL injection. The right practice here is parameterized queries or prepared statements because they provide a reliable, location-agnostic defense against injected SQL.