Which practice prevents SQL injection by treating user input as data rather than executable code?

• A. Parameterized queries with placeholders
• B. Concatenating user input into SQL strings
• C. Using dynamic SQL without validation
• D. Escaping certain characters only

Answer: (A)

Preventing SQL injection comes from treating user input strictly as data, not as part of the SQL command. Parameterized queries with placeholders do this by leaving the SQL code fixed and supplying the user values separately. The database prepares the command structure first, then the bound values are sent, so inputs can’t alter the executable logic. Even if a user enters something that looks like code (for example, a quote or SQL keywords), it’s treated as a literal value for the parameter, not as part of the query.

This approach is safer than building SQL by concatenating user input into the string, which creates a path for attackers to inject additional SQL. It’s also more robust than dynamic SQL without validation, which can be shaped by malicious input, and far more reliable than escaping only certain characters, which often leaves edge cases that bypass escapes or vary by database.

So, parameterized queries with placeholders are the best way to ensure inputs are data, not executable code.