Suppose a web application has a table: user-account with the following columns: email, address, reward-points. Here reward-point is a numeric value that indicated reward points accumulated on this website. The account holder can use the reward points toward purchasing items on the site. One hundred reward points equal to one dollar. The website allows a customer to change his/her address once a customer has successfully logged in. change of address function is implemented using the following SQL statement.

UPDATE USER - ACCOUNT SER address= ' $ { address } ' WHERE Email = 'abc@gmil.com ' ;

1) Provide a malicious input and the resultant SQL query that will achieve the exploit explained in part A.

2) How would you use parameterized SQL statement to mitigate this vulnerability?