What is the definitive defence against SQL injection?
- A Parameterised prepared statements
- B Escaping quotes in input
- C Restricting input length
- D Hiding error messages
Answer
Parameterised prepared statements
Sending query structure separately from values makes it structurally impossible for input to be parsed as SQL.





