Which technique helps prevent SQL injection?

• A. Parameterized queries
• B. Constructing SQL with string concatenation
• C. Disabling input validation
• D. Hard-coding credentials

Answer: (A)

Preventing SQL injection is achieved by parameterized queries. The idea is to write the SQL with placeholders for values and then supply the actual data separately. The database driver binds these values to the placeholders, treating them strictly as data rather than executable code. That separation means even if a user enters SQL keywords or control characters, they won’t alter the structure of the command, so nothing malicious is executed. This approach is essentially what prepared statements implement in practice and is widely recognized as the most reliable defense against SQL injection. Building SQL by concatenating user input embeds data directly into the command, which can turn input into executable code. Skipping validation doesn’t fix that fundamental flaw, and hard-coding credentials doesn’t address the injection risk at all.