{
    "questions": [
        {
            "text": "What is the difference between a prepared statement and a statement?",
            "solutions": {
                "1": "Prepared statements are statements with hard-coded parameters.",
                "2": "Prepared statements are not stored in the database.",
                "3": "A statement is faster executes faster than a prepared statement.",
                "4": "A statement includes actual values, whereas a prepared statement uses placeholders."
            }
        },
        {
            "text": "Which one of the following characters is a placeholder for variables?",
            "solutions": {
                "1": "*",
                "2": "=",
                "3": "?",
                "4": "!"
            }
        },
        {
            "text": "How can prepared statements be faster than statements?",
            "solutions": {
                "1": "Prepared statements are not static, allowing them to be optimized more efficiently than regular statements.",
                "2": "Prepared statements are compiled once by the database management system and then reused with different inputs, reducing compilation overhead.",
                "3": "Since prepared statements are stored and wait for input, they improve performance significantly.",
                "4": "Oracle optimizes prepared statements, making them faster by minimizing the use of database resources."
            }
        },
        {
            "text": "How do prepared statements help prevent SQL injection?",
            "solutions": {
                "1": "Prepared statements have built-in mechanisms to distinguish between user input and SQL logic, preventing malicious manipulation.",
                "2": "Prepared statements use placeholders to enforce rules on allowed input, reducing the risk of SQL injection.",
                "3": "Placeholders prevent user input from being directly appended to the SQL query, ensuring a clear separation between code and data.",
                "4": "Prepared statements treat all user input as literal values, never mixing it with SQL commands."
            }
        },
        {
            "text": "What happens if a person with malicious intent enters the following input into a registration form that uses a prepared statement? Input: Robert); DROP TABLE Students;--",
            "solutions": {
                "1": "The Students table and all its data will be deleted.",
                "2": "The input deletes all students named Robert.",
                "3": "The database registers Robert and then deletes the table.",
                "4": "The database treats the entire input as a plain string: Robert); DROP TABLE Students;-- without executing it as SQL."
            }
        }
    ]
}
