Which mitigation helps prevent SQL injection?

• A. Parameterized queries
• B. Client-side input validation
• C. Output encoding
• D. Content Security Policy

Answer: (A)

The main idea is to prevent user input from changing how SQL statements are executed by treating that input strictly as data, not as part of the code. Parameterized queries (prepared statements) do this by using placeholders in the SQL command and binding real values separately at execution time. This separation makes any input—no matter what it contains—become just a data value, so it can’t alter the query’s structure or logic, even if it includes quotes or SQL keywords. Because the statement’s skeleton is established first, the input cannot be used to inject additional commands or bypass authentication.

The other options don’t provide the same protection. Client-side validation can be bypassed and doesn’t protect how data is used on the server side to form SQL. Output encoding is about safe rendering in web pages to prevent XSS, not about SQL execution. Content Security Policy helps limit what a browser can load or execute, but it doesn’t fix unsafe SQL construction on the server.