SQL injection mitigation best practice?

• A. Parameterized queries and least-privilege database accounts
• B. Escape all input with string replacement
• C. Store credentials in code
• D. Disable database access

Answer: (A)

Parameterized queries prevent SQL injection by separating code from data. When you use prepared statements with placeholders and bind user input as parameters, the database treats the input strictly as data, not as part of the SQL command. This stops any user-supplied text from altering the intended query logic, which is the core way injection happens.

Coupling this with least-privilege database accounts adds another layer of safety: even if an injection attempt slips through, the account the application uses has only the minimum permissions needed. That means an attacker couldn’t perform destructive actions like dropping tables or altering data beyond what the account is allowed to do.

Escaping input with string replacement is brittle and error-prone, because it’s easy to miss edge cases, encodings, or driver specifics, leaving gaps for attackers to exploit. Storing credentials in code is insecure and risks leakage if the codebase is exposed. Disabling database access would cripple the application and isn’t a practical protection against SQL injection.