Exam CAS-004 topic 1 question 637 discussion

The most appropriate recommendation for the security architect is: B. Query parameterization. The code shown is vulnerable to SQL Injection because user input (Request("ItemID")) is being directly concatenated into the SQL query. This creates a potential security risk where an attacker could manipulate the ItemID input to inject malicious SQL code, leading to unauthorized data access, modification, or deletion. Query parameterization (also known as prepared statements) is a secure way to handle user input in SQL queries. It ensures that user input is treated as data, not executable code, preventing SQL injection attacks. Instead of concatenating input into the query, parameterized queries bind user input to predefined placeholders, making it impossible for attackers to alter the query structure.