MENU
During his secure code review, John, an independent application security expert, found that the developer has used Java code as highlighted in the following screenshot. Identify the security mistake committed by the developer?
Suggested Answer: C
Get Premium 312-96 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
34 comments · newest first
LE
Lea
11 months ago
Nah, I think he was trying to use whitelisting.
LE
Leoma
11 months ago
Wow, I can't believe developers still make this mistake!
JA
Jacki
11 months ago
Isn't blacklisting input validation still a thing?
CA
Catrice
12 months ago
Totally agree, that's a big no-no!
DO
Dominque
12 months ago
Looks like he's using a non-parametrized SQL query.
CA
Carlee
1 year ago
I definitely remember that non-parametrized SQL queries are a big no-no, so maybe that's the mistake here.
OL
Oliva
1 year ago
I feel like the developer is making a mistake with input validation, but I can't recall if it's specifically blacklisting or whitelisting.
OR
Oretha
1 year ago
I remember practicing a question about input validation, and I think blacklisting is generally less secure than whitelisting.
ID
Idella
1 year ago
I think the mistake might be related to SQL queries, but I'm not sure if it's about parametrized or non-parametrized ones.
VE
Veronique
1 year ago
This seems straightforward. I'm confident I can identify the security mistake based on the information provided.
NG
Ngoc
1 year ago
Okay, I've got a strategy. I'll go through the options and eliminate the ones that don't match the code I'm seeing.
DA
Dalene
1 year ago
Ah, I think I see the issue here. Let me double-check my understanding before selecting the answer.
NA
Nana
1 year ago
I'm a bit confused by the code snippet. I'll need to review my notes on secure coding practices to figure this out.
AN
Antonette
1 year ago
Hmm, this looks like a tricky one. I'll need to carefully analyze the code to identify the security mistake.
BA
Barrett
1 year ago
I bet the developer is just trying to make the code 'edgy' by using Blacklisting. Gotta stay hip, you know? But security should come first, not fashion.
LO
Lorean
1 year ago
Seriously, who uses Non-parametrized SQL queries these days? The developer must be living in the stone age or something.
MA
Mable
1 year ago
C) He is trying to use Blacklisting Input Validation
WI
Willodean
1 year ago
B) He is trying to use Non-parametrized SQL query
SK
Skye
1 year ago
C) He is trying to use Blacklisting Input Validation
MA
Mari
1 year ago
B) He is trying to use Non-parametrized SQL query
XO
Xochitl
1 year ago
A) He is trying to use Whitelisting Input Validation
JU
Julio
1 year ago
A) He is trying to use Whitelisting Input Validation
DA
Daron
2 years ago
Ah, the old Whitelist vs. Blacklist debate. I'm with John on this one - Blacklisting is a recipe for disaster. Does the developer even know what they're doing?
DE
Dell
2 years ago
Parametrized SQL Query is the way to go, my friend. Gotta keep those nasty SQL injections at bay!
LE
Leslie
1 year ago
D) He is trying to use Parametrized SQL Query
EA
Earleen
1 year ago
C) He is trying to use Blacklisting Input Validation
MI
Ming
1 year ago
B) He is trying to use Non-parametrized SQL query
ON
Onita
1 year ago
A) He is trying to use Whitelisting Input Validation
HO
Howard
2 years ago
Looks like the developer is trying to use Blacklisting Input Validation, which is a big no-no. Can't believe they're still using that outdated technique!
QU
Quiana
1 year ago
Yes, Blacklisting Input Validation is not secure and can easily be bypassed by attackers.
IR
Irma
1 year ago
Developer should be using Parametrized SQL Query instead of Blacklisting Input Validation.
GE
Gearldine
2 years ago
I believe the correct approach would be to use Parametrized SQL Query for better security.
PA
Pamella
2 years ago
I agree with Terrilyn. Non-parametrized SQL queries are vulnerable to SQL injection attacks.
TE
Terrilyn
2 years ago
I think the developer made a mistake by using Non-parametrized SQL query.