hard20 pts · first answer countssqlsecurity

Sorting by a user-chosen column

An endpoint accepts ?sort=created_at. A developer writes ORDER BY $1 with the value as a bound parameter, and the results are not sorted. What is the right approach?

A.Concatenate the raw sort value into the SQL string, since parameters cannot be used in ORDER BY at allB.Parameters bind values, not identifiers; map the input to an allowlist of column namesC.Escape single quotes in the value and then concatenate itD.Cast it as ORDER BY $1::column so the database reads it as a column name

← return versus return await in try Pool exhausted during payments →