Data Modeling easy
Which practice prevents SQL Injection attacks?
- A Providing the database with a private, isolated network subnet (VPC) that prevents all incoming traffic from untrusted public IP addresses.
- B Migrating the entire application stack from a relational SQL database to a document-oriented NoSQL engine that lacks a standard query parser.
- C Implementing hardware-level AES-256 encryption for the entire physical disk array to ensure that data remains inaccessible to offline attackers.
- D Utilizing Parameterized Queries (Prepared Statements) that strictly treat all incoming user input as data rather than executable code.
Answer: D. Utilizing Parameterized Queries (Prepared Statements) that strictly treat all incoming user input as data rather than executable code.
SQL Injection occurs when untrusted input is concatenated into a raw SQL string, allowing an attacker to 'break out' of the intended query and execute malicious commands. Parameterized queries eliminate this risk by pre-compiling the SQL command and binding the user input to specific placeholders afterward, ensuring that input can never be parsed as part of the query logic.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- When modeling a Distributed Transaction using the Saga Pattern (Choreography or Orchestration), what type of consistency do you achieve?
- What is 'Bi-Temporal' data modeling (e.g., in SQL:2011 standard)?
- Adding an Index to a database column generally improves Read performance. What is the negative trade-off?
- Log Systems Merge (LSM) Trees (used in RocksDB, Cassandra) optimize for fast writes. What is their primary downside regarding Disk I/O?
- What is the primary objective of normalizing a relational database schema (e.g., to 3NF)?
- You are modeling a 'Likes' counter for a global social network. You choose an AP model. What anomaly must your data model handle?