IPA FE Subject A 2024 Question 10

Build statements by using placeholders — a placeholder keeps the input out of the SQL statement’s structure, so input can never be run as SQL.

SQL injection works when an application builds a statement by joining strings with the user’s input: an input such as ' OR '1'='1 closes the string literal and changes what the statement does. With placeholders (a prepared statement such as SELECT name FROM users WHERE id = ?), the statement is compiled first with ? in place of each value, and the input is bound to it afterwards as a value only. Whatever characters the input contains, it is treated as data, never as part of the SQL.

Answer (d)

Why not others:

• •(a) — allowing only URLs that start with “http://” or “https://” in the output blocks javascript: URLs, a countermeasure against cross-site scripting
• •(b) — not letting an outside parameter name a file on the server directly is a countermeasure against directory traversal
• •(c) — not loading style sheets from arbitrary websites is a countermeasure against cross-site scripting through style sheets (CSS injection)

Key rule: Against SQL injection, use placeholders (prepared statements with bound values) so input is passed as data; escaping special characters is the fallback when placeholders cannot be used.

Security · AI-written, may contain errors