Which practice reduces the risk of log injection by ensuring log content cannot be interpreted as code?

Which practice reduces the risk of log injection by ensuring log content cannot be interpreted as code?

• A. Sanitize outbound log messages
• B. Enable verbose logging
• C. Log every input
• D. Do not log user data

Answer: (A)

Sanitizing outbound log messages reduces log injection risk by neutralizing untrusted content before it is written to logs. This means escaping or removing dangerous characters and encoding values in a safe format so that the content cannot be interpreted as code or commands by log parsers, terminals, or downstream systems. By treating log entries as plain data and applying proper escaping (such as handling newlines, quotes, and control characters, or encoding with JSON/URL encoding), you prevent attackers from altering log structure, injecting unintended entries, or triggering code in tools that process logs. This protection remains effective no matter how logs are stored, transmitted, or displayed. Enabling verbose logging or logging every input tends to increase the amount of data and can show more attacker-supplied content, not reduce the risk of injection. Not logging user data reduces exposure of sensitive content but does not address the potential to inject or alter log formatting in the first place.

Sanitizing outbound log messages reduces log injection risk by neutralizing untrusted content before it is written to logs. This means escaping or removing dangerous characters and encoding values in a safe format so that the content cannot be interpreted as code or commands by log parsers, terminals, or downstream systems. By treating log entries as plain data and applying proper escaping (such as handling newlines, quotes, and control characters, or encoding with JSON/URL encoding), you prevent attackers from altering log structure, injecting unintended entries, or triggering code in tools that process logs. This protection remains effective no matter how logs are stored, transmitted, or displayed.

Enabling verbose logging or logging every input tends to increase the amount of data and can show more attacker-supplied content, not reduce the risk of injection. Not logging user data reduces exposure of sensitive content but does not address the potential to inject or alter log formatting in the first place.