They ought to encourage the use of prepared statements to defend against SQL injections. It's the only way to handle that threat, yet the report does not mentio

They ought to encourage the use of prepared statements to defend against SQL injections. It's the only way to handle that threat, yet the report does not mention it: "5. Input Validation - Input validation is a method of sanitizing untrusted user input provided by users of a web application, and may prevent many types of web application security flaws, such as SQLi, XSS, and command injection." https://en.wikipedia.org/wiki/Prepared_statement https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet