Question
A security architect discovers the following while reviewing code for a company's website:
```
selection = "SELECT Item FROM Catalog WHERE ItemID = " & Request("ItemID")
```
Which of the following should the security architect recommend?
- A. Client-side processing
- B. Query parameterization Correct
- C. Data normalization
- D. Escape character blocking
- E. URL encoding
Explanation
The code concatenates user input straight into a SQL statement, which allows SQL injection. Parameterized queries (prepared statements) send the input as data, separate from the SQL command, so it can never change the query's structure. Client-side processing can be bypassed, escaping or blocking characters is error-prone and incomplete, and URL encoding and data normalization do not stop injection.
