Which practice best reduces the risk of SQL injection during testing?

• A. Test against production with live data.
• B. Use dynamic SQL concatenation for test payloads.
• C. Use parameterized queries and avoid dynamic query construction.
• D. Grant elevated privileges to the test database.

Answer: (C)

Using parameterized queries and avoiding dynamic query construction is the strongest safeguard against SQL injection in testing. When you parameterize, you separate the SQL code from the data. Inputs are bound as values, not concatenated into the SQL string, so even if a tester provides something that looks like an extra SQL command, it’s treated as data and cannot alter the query’s structure. The database driver handles escaping and typing automatically, which blocks injection across different query shapes and payloads. This approach keeps tests secure whether you’re testing simple lookups or more complex operations, and it minimizes the chance that test inputs can turn into malicious code.

Testing against production with live data increases risk by exposing sensitive information and system behavior to tests. Using dynamic SQL concatenation for test payloads directly creates injection opportunities, exactly the risk you want to avoid. Granting elevated privileges to the test database is about access control, not reducing injection risk, and it compounds potential damage if something goes wrong.