1. What is the safest general defense pattern against SQL Injection in modern apps?
Difficulty: EasyType: MCQTopic: Web Security
Prepared statements keep user input separate from the query plan, so the database treats it as data, not code. This is simpler and more reliable than trying to blacklist keywords. OWASP’s SQL Injection materials stress parameterized queries, least privilege, and safe ORM patterns as primary defenses.
Example code
db.query("SELECT * FROM users WHERE email = ?", [email])