A developer uses Ruby on Rails with 'attr_accessible' and 'strong parameters'. A security audit praises this pattern. What attack does Rails' strong parameters pattern specifically defend against?

• A.Cross-site request forgery: strong parameters add a token (the authenticity token) to each form, so a forged POST from another site is rejected before the controller runs by the framework
• B.Mass assignment: Rails strong parameters require explicit whitelisting of which request parameters are permitted to be assigned to model attributes, preventing attackers from injecting unexpected parameters (like 'admin: true') that the ORM would otherwise update directly
• C.SQL injection: strong parameters bind each value into the query (a prepared statement), so the attacker's quotes are treated as data by the database driver of the Active Record layer
• D.Cross-site scripting: strong parameters escape each value (HTML entities) before it reaches the view, so injected tags are shown as text in the browser of the next visitor who opens the comments page