Which approach best prevents SQL injection in an application using MySQL?
- A Escaping quotes manually in every query
- B Using parameterised prepared statements
- C Restricting query length
- D Disabling error messages
Answer
Using parameterised prepared statements
Parameterised queries make injection structurally impossible because values never form part of the parsed SQL. Escaping is fragile and easy to apply inconsistently.





