SQL for Java Devs · interview question

Which of the following is a correct way to use a PreparedStatement to prevent SQL injection in an e-commerce application?

Multiple choiceHardchapter-8-curatedpremiumsql-for-java-devspreparedstatements

String query = "SELECT * FROM products WHERE id = " + productId;PreparedStatement stmt = connection.prepareStatement("SELECT * FROM users WHERE email =?"); stmt.setString(1, userEmail);String query = "INSERT INTO orders (customer_id, amount) VALUES ('" + customerId + "', '" + amount + "')";PreparedStatement stmt = connection.prepareStatement("DELETE FROM cart WHERE user_id = '" + userId + "'");

Answer and explanation

Correct answer

B. PreparedStatement stmt = connection.prepareStatement("SELECT * FROM users WHERE email =?"); stmt.setString(1, userEmail);

Why

The correct usage involves binding parameters using placeholders ('?') and setting values with methods like setString(). This ensures that input is treated as data, not executable code, thus preventing SQL injection.

Test yourself on SQL for Java Devs

A free test with instant, explained results. No account needed.

Start free test

All SQL for Java Devs questions →

Which of the following is a correct way to use a PreparedStatement to prevent SQL injection in an e-commerce application?

Correct answer

Why

More SQL for Java Devs questions