Which type of attacks are mitigated by parameterized queries and safe coding practices?

• A. Phishing
• B. Denial of Service
• C. Injection attacks (SQL, Buffer/Heap/Integer Overflow)
• D. Social Engineering

Answer: (C)

Parameterized queries work by separating code from data. When you use prepared statements or parameterized queries, user input is treated strictly as data, not as part of the query’s instructions. That means even if an attacker tries to inject SQL code through input fields, it won’t be executed because the input isn’t allowed to alter the query’s structure. Safe coding practices reinforce this by validating and sanitizing input, avoiding unsafe string concatenation, and using memory-safe approaches to prevent other input-driven vulnerabilities. Together, these practices tackle injection-style attacks, including SQL injection and related overflow-style abuses that can occur when untrusted input is mishandled. Phishing and social engineering are human-factor attacks and Denial of Service is a different category, so they aren’t addressed by parameterized queries.