[Solved] Which of the following SQL query constructions is syntactically correct and safe from injection? — Ans: SELECT * FROM users WHERE name = ?; | SQL

SQL - Security Basics

Which of the following SQL query constructions is syntactically correct and safe from injection?

ASELECT * FROM users WHERE name = ?;

BSELECT * FROM users WHERE name = '" + userInput + "';

CSELECT * FROM users WHERE name = userInput;

DSELECT * FROM users WHERE name = CONCAT(userInput);

Step-by-Step Solution

Solution:

Step 1: Review each option's syntax and safety
SELECT * FROM users WHERE name = '" + userInput + "'; uses string concatenation, vulnerable to injection. SELECT * FROM users WHERE name = userInput; treats userInput as a column, causing error. SELECT * FROM users WHERE name = CONCAT(userInput); misuses CONCAT function.
Step 2: Identify the safe parameterized query
SELECT * FROM users WHERE name = ?; uses a placeholder '?', which is standard for parameterized queries and safe.
Final Answer:
SELECT * FROM users WHERE name = ?; -> Option A
Quick Check:
Safe syntax = parameter placeholder [OK]

Quick Trick: Use '?' placeholders for safe parameterized queries [OK]

Common Mistakes:

Master "Security Basics" in SQL

9 interactive learning modes - each teaches the same concept differently

More SQL Quizzes

Which of the following SQL query constructions is syntactically correct and safe from injection?