Web Security · Middle · Question 63 of 75

How do you prevent SQL injection?

db.query("SELECT * FROM users WHERE email = '" + email + "'");

1Remove single quotes from email with replace
✓Correct answer: Use parameterized queries: db.query('SELECT * FROM users WHERE email = $1', [email])
3Limit email to 50 characters

Explanation

With parameters, the database receives the query and the data separately, so input can never change the query's structure.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.