SQL for Java Devs · interview question
In JDBC, how do you ensure that SQL injection is prevented when executing a query that searches for a user by email?
Multiple choiceMediumchapter-8-curatedpremiumsql-for-java-devsindexes
PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE email = ?");
ps.setString(1, userEmail);Answer and explanation
Correct answer
B. Use PreparedStatement and setString() to bind values.
Why
PreparedStatement allows setting parameters in a query template, which is a safe method to prevent SQL injection. The query is precompiled, and parameters are set separately.
Test yourself on SQL for Java Devs
A free test with instant, explained results. No account needed.
More SQL for Java Devs questions
- How can JDBC transactions help maintain data integrity during an e-commerce checkout process?
- What would be the effect of not closing a PreparedStatement in a Java application?
- Why do teams use SQL JOINs to fetch relational data in a single query in production code?
- What should a repository method mainly encapsulate?
- How can you prevent the N+1 query problem when retrieving a list of orders with their customer details?
- How can using a PreparedStatement benefit a Java application that frequently executes the same query with different…