SQL injection in Cybersecurity - Mini Project: Build & Apply

Understanding SQL Injection

📖 Scenario: You are learning about web security. Many websites use databases to store user information. Sometimes, if the website code is not careful, attackers can trick the database with special inputs. This is called SQL injection.Imagine a website login form that asks for a username and password. If the website does not check the input properly, an attacker can enter code that changes the database query and gains access without a real password.

🎯 Goal: Build a simple example of a SQL query that is vulnerable to SQL injection. Then, create a safer version that avoids this problem.

📋 What You'll Learn

Create a SQL query string that uses user input directly

Add a variable for user input representing a username

Write a SQL query that includes the username variable without safety checks

Write a safer SQL query using parameter placeholders

💡 Why This Matters

🌍 Real World

Web developers and security professionals must understand SQL injection to protect websites and user data from attackers.

💼 Career

Knowledge of SQL injection is essential for roles in cybersecurity, web development, and database administration to ensure safe and secure applications.

1

Set up the user input variable

Create a variable called username and set it to the string "admin".

Cybersecurity

# Create a variable called username and set it to "admin"
# Your code here

Hint

Use the equals sign = to assign the string "admin" to the variable username.

2

Create a vulnerable SQL query string

Create a variable called query_vulnerable that builds a SQL query string by directly inserting the username variable into the query using string concatenation. The query should be: SELECT * FROM users WHERE username = ' plus the username plus ';

Cybersecurity

username = "admin"
# Create a vulnerable SQL query string using username
# Your code here

Hint

Use string concatenation with + to build the query string including the username variable.

3

Explain how SQL injection can happen

Add a comment explaining that if username contains special characters like ' OR '1'='1, the query becomes unsafe and can allow unauthorized access.

Cybersecurity

username = "admin"
query_vulnerable = "SELECT * FROM users WHERE username = '" + username + "';"
# Add a comment explaining SQL injection risk
# Your code here

Hint

Write a comment starting with # describing the risk of special input in username.

4

Create a safer SQL query using parameters

Create a variable called query_safe that contains the SQL query string with a parameter placeholder ? instead of inserting the username directly. The query should be: SELECT * FROM users WHERE username = ?;

Cybersecurity

username = "admin"
query_vulnerable = "SELECT * FROM users WHERE username = '" + username + "';"
# If username contains something like "' OR '1'='1", this query allows SQL injection and unauthorized access
# Create a safer SQL query string using a parameter placeholder
# Your code here

Hint

Use a question mark ? as a placeholder in the query string to safely insert user input later.

Practice

1. What is SQL injection in cybersecurity?

easy

A. A method to speed up database queries

B. A way to backup database data securely

C. A technique to trick databases into running harmful commands

D. A process to encrypt database connections

Solution

1. Step 1: Understand SQL injection meaning

   SQL injection is a cyberattack where harmful commands are inserted into database queries.

2. Step 2: Identify correct description

   Only the technique to trick databases into running harmful commands describes this attack method accurately.

3. Final Answer:

   A technique to trick databases into running harmful commands -> Option C

4. Quick Check:

   SQL injection = harmful commands trick [OK]

Hint: SQL injection tricks databases with harmful commands [OK]

Common Mistakes:

• Confusing SQL injection with database backup
• Thinking SQL injection speeds up queries
• Mixing SQL injection with encryption

2. Which of the following is a correct way to prevent SQL injection?

easy

A. Using parameterized queries or prepared statements

B. Directly inserting user input into SQL queries without checks

C. Ignoring user input validation

D. Allowing all user inputs without restrictions

Solution

1. Step 1: Review prevention methods

   Safe coding practices include using parameterized queries to separate code from data.

2. Step 2: Identify correct prevention

   Using parameterized queries or prepared statements correctly states using parameterized queries or prepared statements to prevent injection.

3. Final Answer:

   Using parameterized queries or prepared statements -> Option A

4. Quick Check:

   Safe queries = parameterized/prepared [OK]

Hint: Use parameterized queries to stop SQL injection [OK]

Common Mistakes:

• Directly inserting unchecked user input
• Skipping input validation
• Assuming all inputs are safe

3. Consider this SQL query in a login system:
SELECT * FROM users WHERE username = 'admin' AND password = 'password123';
What happens if an attacker inputs ' OR '1'='1 as the password?

medium

A. The query returns no results

B. The query causes a syntax error

C. The query only returns the admin user

D. The query returns all users, bypassing password check

Solution

1. Step 1: Analyze injected input effect

   The input ' OR '1'='1' changes the WHERE clause to always true, bypassing password check.

2. Step 2: Understand query result

   Because '1'='1' is always true, the query returns all users, ignoring password.

3. Final Answer:

   The query returns all users, bypassing password check -> Option D

4. Quick Check:

   Injection ' OR '1'='1' = bypass password [OK]

Hint: Injection ' OR '1'='1' bypasses password check [OK]

Common Mistakes:

• Thinking it causes syntax error
• Assuming it returns no results
• Believing it returns only admin user

4. A developer wrote this SQL query:
query = "SELECT * FROM users WHERE name = '" + user_input + "';"
What is the main problem with this code?

medium

A. It concatenates user input directly into the query, risking SQL injection

B. It prevents SQL injection by validating input

C. It properly escapes user input

D. It uses parameterized queries correctly

Solution

1. Step 1: Examine query construction

   The code builds the SQL query by adding user input directly into the string.

2. Step 2: Identify security risk

   This direct concatenation allows attackers to inject malicious SQL commands.

3. Final Answer:

   It concatenates user input directly into the query, risking SQL injection -> Option A

4. Quick Check:

   Direct concatenation = SQL injection risk [OK]

Hint: Never concatenate user input directly into SQL queries [OK]

Common Mistakes:

• Assuming concatenation is safe
• Thinking input is automatically escaped
• Believing this code validates input

5. You have a web form that accepts a username to search a database. Which approach best protects against SQL injection when building the query?

hard

A. Use string concatenation with manual input cleaning

B. Use parameterized queries with placeholders for user input

C. Allow all input and filter results after query

D. Disable database error messages only

Solution

1. Step 1: Evaluate protection methods

   Parameterized queries separate code from data, preventing injection regardless of input.

2. Step 2: Compare options

   Use parameterized queries with placeholders for user input uses placeholders safely; other options either rely on unsafe cleaning or do not prevent injection.

3. Final Answer:

   Use parameterized queries with placeholders for user input -> Option B

4. Quick Check:

   Best protection = parameterized queries [OK]

Hint: Always use parameterized queries to prevent injection [OK]

Common Mistakes:

• Relying on manual input cleaning
• Filtering results after query is unsafe
• Only hiding error messages does not protect