Which types of queries do you consider the safest and why?

The safest are considered to be parameterized (prepared) queries and ORM queries, which automatically escape input data.

The reason is that they prevent SQL injection — when an attacker inserts malicious SQL code through user input.

Example:

• In a parameterized query, parameters are passed separately from the SQL code, which excludes the possibility of changing the query structure.

• Unlike string concatenation, where user input is directly inserted into the query.

For example, in Java with JDBC:

String sql = "SELECT * FROM users WHERE username = ?";
PreparedStatement ps = connection.prepareStatement(sql);
ps.setString(1, userInput);
ResultSet rs = ps.executeQuery();

This approach is safer than:

String sql = "SELECT * FROM users WHERE username = '" + userInput + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(sql);

Therefore, for security in testing and development, it is recommended to use parameterized queries.