Security Fundamentals Practice Question 8: SQL Injection Defence
Security Fundamentals · Test 1 · question 8 of 10
A penetration test finds that an application's search box is vulnerable to SQL injection. The code builds its query by concatenating the user's search text into the SQL string. The team already runs a web application firewall (WAF) in front of the app. What is the primary fix OWASP recommends?
Show answer and explanation
Answer:
SQL injection happens when user input is mixed into the query text, so the database cannot tell data apart from code. A parameterized query sends the SQL structure and the user's values separately, and the database always treats the values as data. OWASP lists prepared statements with parameterized queries as Defense Option 1 and says developers should be taught to write queries this way (D).
- A is wrong because a WAF is a useful additional layer, but it filters patterns and can be bypassed. It does not remove the flaw in the code. OWASP presents such measures as additional defenses for defence in depth, on top of fixing the query. - B is wrong because OWASP labels escaping all user-supplied input "STRONGLY DISCOURAGED". It is fragile, database-specific, and easy to get wrong. - C is wrong because the injected SQL runs through the application's own database connection. Encryption at rest protects stolen disks and backups, but a query issued by the app gets back decrypted results.
Reference: OWASP SQL Injection Prevention Cheat Sheet