easy5 pts · first answer countssecuritysql

Preventing SQL injection

A login handler builds a query by joining strings with the email from the request. What is the correct way to prevent SQL injection?

const sql = "SELECT * FROM users WHERE email = '" + req.body.email + "'"

A.Convert the email to lowercase firstB.Check on the frontend that the email field is not emptyC.Wrap the whole query in a try/catch blockD.Use a parameterized query or ORM, so the email is sent as a value and never as SQL text

← fetch and error status codes Storing user passwords →