Application Security: OWASP and Secure Coding

1. A search endpoint builds its SQL by concatenating the search term, after replacing each single quote with two. A reviewer still flags it. What is the right fix?

• Also strip semicolons and comment markers from the term before it is concatenated
• Rewrite it as a parameterised query and bind the search term as a parameter
• Base64-encode the search term so that no quote characters ever reach the query
• Limit the search term to 50 characters so a long attack string cannot fit in it

2. An API lets clients choose the sort column with ?sort=name. Binding the column name as a query parameter fails. What should the code do instead?

• Escape the column name with the driver's quoting function and then concatenate it
• Wrap the column name in double quotes so the database reads it as an identifier
• Accept the value only if it is shorter than the longest column name in the table
• Map the value to one of a fixed set of known column names and reject anything else

3. Which of these does NOT prevent SQL injection?

• Binding every user-supplied value as a parameter of a prepared statement
• Using the ORM's query builder methods so values are passed as bound parameters
• Hiding database error messages from users and showing a generic error page
• Mapping user-chosen sort columns to a fixed allowlist of known column names