Study. uk . com
  1. Home
  2. All questions
  3. Question 581

CompTIA Security+ study material · question 581 of 611

Where does escaping input sit among OWASP's SQL injection defences?

  1. It is the primary defence
  2. It is not a recognised defence
  3. It is a last resort, being database-specific and easy to get wrong
  4. It is equivalent to parameterisation
Show the answer

Answer: C. It is a last resort, being database-specific and easy to get wrong

Parameterised queries come first; escaping is reserved for cases where nothing else is possible.

Source: OWASP SQL Injection Prevention Cheat Sheet (OWASP) — OWASP SQL Injection Prevention Cheat Sheet › Defense Options

Challenge yourself on this topic → Study as cards