easy5 pts · first answer countssecuritysql

Stopping SQL injection

This login code builds SQL by joining strings with user input. What is the correct way to prevent SQL injection?

const sql = "SELECT * FROM users WHERE email = '" + email + "'"
await db.query(sql)

A.Remove all single quotes from the email before building the queryB.Validate the email on the frontend with a regexC.Run the query inside a database transactionD.Use a parameterized query, e.g. db.query("SELECT * FROM users WHERE email = $1", [email])

← The non-idempotent method How to store passwords →