ISC2 CISSP Practice Question

Parameterized queries (also known as prepared statements) are the correct solution because they separate SQL code from data by using placeholders for parameters. This ensures that user input is always treated as data rather than executable code, effectively preventing SQL injection attacks regardless of the input content.

Input sanitization involves filtering or cleaning user input to remove potentially malicious characters. While this can help reduce the risk of SQL injection, it is not as reliable as parameterized queries because sanitization filters can often be bypassed by sophisticated attacks and may not address all possible injection vectors.

Error handling focuses on managing application responses when errors occur. While proper error handling is important for security (preventing information leakage that could aid an attacker), it does not prevent SQL injection attacks from occurring in the first place. It might hide error details from attackers but does not fix the underlying vulnerability.

Secure logging is the practice of properly recording application events without exposing sensitive information. While logging is crucial for security monitoring and incident response, it does not prevent SQL injection attacks. Logging would only record that an attack happened but would not stop it from succeeding.