Study. uk . com
  1. Home
  2. All questions
  3. Question 142

CompTIA Security+ study material · question 142 of 611

A report lets the user choose which column to sort by, and the column name goes into the query. Parameters cannot bind an identifier. What is the correct defence?

  1. Escape the column name before concatenating it
  2. Map the user's choice against an allow-list of permitted column names
  3. Move the query into a stored procedure
  4. Reject any request containing a space
Show the answer

Answer: B. Map the user's choice against an allow-list of permitted column names

Identifiers cannot be bound as parameters, so the only safe pattern is selecting from a fixed set of known-good values.

Source: OWASP SQL Injection Prevention Cheat Sheet (OWASP) — OWASP SQL Injection Prevention Cheat Sheet › Defense Option 4

Challenge yourself on this topic → Study as cards