Which method is commonly used to prevent SQL injection attacks?

• A. Using basic text fields in forms
• B. Employing prepared statements and parameterized queries
• C. Limiting database access to only administrators
• D. Implementing regular password changes

Answer: (B)

Employing prepared statements and parameterized queries is a widely recognized method for preventing SQL injection attacks. This approach allows developers to separate SQL code from data inputs. With prepared statements, SQL queries are defined with placeholders for parameters, and the actual data is bound to these parameters later. This technique ensures that any user input is treated strictly as data and not executable SQL code. As a result, any malicious input intended to manipulate the SQL query will not alter the intended SQL logic, effectively mitigating the risk of SQL injection.

Using basic text fields in forms does not inherently provide any defense against SQL injection. When user inputs are directly inserted into SQL queries without sanitation or validation, it opens the door for attackers to inject harmful SQL code. Limiting database access to only administrators is more about access control rather than protection against SQL injection. While it helps safeguard sensitive data and restricts who can execute SQL commands, it does not prevent SQL injection vulnerabilities in the application itself. Regular password changes pertain to account security and do not address the structural issues that allow SQL injection to occur.