OWASP for MVC Developers

1. What is the primary defense against SQL injection in EF Core LINQ queries?

Using raw SQL strings without parameters Automatic parameterization of queries String interpolation in SQL commands Using `SqlCommand` without input validation

2. When might you use `Html.Raw()` in a Razor view?

For all user input rendering For rendering controlled CMS content For embedding scripts without encoding As a default output method

3. What role does the anti-forgery token serve in a web application?

Validates SQL queries Prevents CSRF attacks Executes AJAX requests Handles user authentication

4. What is the recommended approach to prevent over-posting in ASP.NET MVC applications?

Using `[Bind]` attributes on entities Accepting ViewModels with limited fields Allowing all model properties to be set Relying on client-side validation

Continue: Protecting Sensitive Records → Review this lesson Retake quiz