SQL injection · Question 9 of 12
A column name for sorting comes from user input. How do you handle it correctly?
1 answer is correct. Medium
Show answer
Answer
- C Check it against a list of allowed columns
Explanation
Parameters only bind values, not identifiers such as columns or tables. Only an allowlist helps for them, additionally quoteIdentifier().