Engineering Interviews · interview question

In the context of SQL injection, which code snippet is most vulnerable?

Multiple choiceMediumchapter-20-curatedpremiumengineering-interviewscode-review-spotting-bugs

PreparedStatement stmt = connection.prepareStatement("SELECT * FROM users WHERE id =?");String query = "SELECT * FROM users WHERE id = " + userId;String query = "SELECT * FROM users WHERE id =?";Use a stored procedure for SQL execution.

Answer and explanation

Correct answer

B. String query = "SELECT * FROM users WHERE id = " + userId;

Why

Using string concatenation to build SQL queries is highly vulnerable to SQL injection attacks. Prepared statements or parameterized queries should be used instead.

Test yourself on Engineering Interviews

A free test with instant, explained results. No account needed.

Start free test

In the context of JVM memory architecture, what is the primary role of the 'stack'?
Why is it important to first outline a high-level design before diving into coding during a system design interview?
During a live coding interview, why is it important to verbalize your thought process?
What does the 'Result' component in the STAR framework mainly aim to achieve?
Why is it crucial to agree on an algorithm before writing code in a live coding interview?
In a code review, which type of bug is most critical to address immediately?

All Engineering Interviews questions →

In the context of SQL injection, which code snippet is most vulnerable?

Correct answer

Why

More Engineering Interviews questions