Question

A developer reviews a customer login endpoint that constructs a database query by concatenating user-supplied username and password strings directly into a SQL statement. Penetration testers demonstrated that entering a crafted username allowed authentication bypass and dumping of the user table. Which remediation most fundamentally eliminates this class of vulnerability?

Accepted Answer

Use parameterized queries (prepared statements) so user input is treated strictly as data, never executable SQL

Answer

Deploy a web application firewall with signatures that block known SQL injection payload patterns

Answer

Enforce a strict maximum length on the username and password input fields

Answer

Encrypt the database connection using TLS and hash stored passwords with a salt