Which technique ensures SQL queries treat user input strictly as data, preventing injection?

• A. Dynamic SQL
• B. Parameterized Queries
• C. ORM
• D. Stored Procedures

Answer: (B)

Parameterization keeps user input separate from the SQL code, so input is treated strictly as data. The query is written with placeholders, and the actual values are bound separately. The database compiles the query with the placeholders and then binds the data, so whatever the user provides cannot be interpreted as part of the SQL command. This blocks attempts to alter the query’s structure, such as injecting a malicious string to change the logic.

This approach often uses prepared statements, which can improve performance by reusing the same plan with different values and ensures proper type handling for the bound data. In contrast, dynamic SQL builds the query string by concatenating user input, which allows input to become part of the SQL itself and enables injection. Stored procedures can be safe if they consistently use parameterized calls and avoid constructing SQL from input; otherwise, they can be vulnerable if they rely on dynamic SQL. ORMs typically promote parameterized queries, but you must use them correctly to maintain the separation of code and data.