You

are developing an ASP.NET MVC application that uses forms authentication. The application uses SQL queries that display customer order data.

Logs show there have been several malicious attacks against the servers.

You need to prevent all SQL injection a

ttacks from malicious users against the application.

How should you secure the queries?

A. Check the input against patterns seen in the logs and other records.

B. Escape single quotes and apostrophes on all string-based input parameters.

C. Implement par

ameterization of all input strings.

D. Filter out prohibited words in the input submitted by the users.

Explanation:

SQL Injection Prevention, Defense Option 1: Prepared Statements (Parameterized Queries)

The use of prepared statements (aka para

meterized queries) is how all developers should first be taught how to write database queries. They are simple to write, and easier to understand than dynamic queries. Parameterized queries force the developer to first define all the SQL code, and then pas

s in each parameter to the query later. This coding style allows the database to distinguish between code and data, regardless of what user input is supplied.

Prepared statements ensure that an attacker is not able to change the intent of a query, even if

SQL commands are inserted by an attacker.

Reference: SQL Injection Prevention Cheat Sheet

You are developing an ASP.NET MVC application that uses forms authentication. The application uses SQL queries that display customer order data.

You need to prevent all SQL injection attacks against the applica

tion.

How should you secure the queries?

A. Implement parameterization.

B. Pattern check the input.

C. Filter out prohibited words in the input.

D. Escape single quotes on string-based input parameters.

Explanation:

With most development

platforms, parameterized statements that work with parameters can be used (sometimes called placeholders or bind variables) instead of embedding user input in the statement. A placeholder can only store a value of the given type and not an arbitrary SQL fr

agment. Hence the SQL injection would simply be treated as a strange (and probably invalid) parameter value.

Reference: https://en.wikipedia.org/wiki/SQL_injection#Parameterized_statements