A utilities lookup API builds database queries by concatenating citizen-supplied IDs into SQL strings. Which change is the primary SQL injection mitigation?
Select an answer to reveal the explanation.
Short Explanation
Gluing user text into SQL is like letting strangers finish your sentences in the ledger. Bind parameters (or ORM placeholders) so input stays data, not code.
Full Explanation
SQL injection mitigation requires parameterized queries or equivalent ORM binding so untrusted text cannot alter statement structure. Concatenating into WHERE clauses is the vulnerability. CSRF tokens and HTML encoding target other threat classes; a WAF without parameterization is not the named primary fix.