SQL injection in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely query a database using a parameterized statement.

Cybersecurity

cursor.execute("SELECT * FROM users WHERE username = [1]", (username,))

Drag options to blanks, or click blank then click option'

A?

Busername

C%s

D'

Attempts:

3 left

💡 Hint

Common Mistakes

Using string concatenation instead of placeholders.

Using quotes directly around variables.

The placeholder %s is used in parameterized queries to safely insert variables and prevent SQL injection.

2fill in blank

medium

Complete the code to prevent SQL injection by escaping user input.

Cybersecurity

safe_input = connection.escape_string([1])

Drag options to blanks, or click blank then click option'

Apassword

Buser_input

Cquery

Dcursor

Attempts:

3 left

💡 Hint

Common Mistakes

Escaping the wrong variable like the query or cursor.

Not escaping user input at all.

The user input must be escaped to prevent malicious SQL code from executing.

3fill in blank

hard

Fix the error in the SQL query to avoid injection risks.

Cybersecurity

query = "SELECT * FROM users WHERE username = [1]"

Drag options to blanks, or click blank then click option'

Ainput

Busername

Cuser_input

D%s

Attempts:

3 left

💡 Hint

Common Mistakes

Using string formatting with % operator directly on user input.

Not using parameterized queries.

Using %s as a placeholder and passing parameters separately prevents SQL injection.

4fill in blank

hard

Fill both blanks to create a safe SQL query using parameterized inputs.

Cybersecurity

query = "SELECT * FROM users WHERE email = [1]"
cursor.execute(query, ([2],))

Drag options to blanks, or click blank then click option'

A%s

Bemail

Cuser_email

Attempts:

3 left

💡 Hint

Common Mistakes

Putting the variable directly into the query string.

Not passing parameters as a tuple.

The query uses %s as a placeholder, and the actual user email is passed as a parameter to execute.

5fill in blank

hard

Fill all three blanks to safely insert a new user into the database.

Cybersecurity

query = "INSERT INTO users (username, password) VALUES ([1], [2])"
cursor.execute(query, ([3], password))

Drag options to blanks, or click blank then click option'

A%s

Busername

Cuser_name

Attempts:

3 left

💡 Hint

Common Mistakes

Not using placeholders for both values.

Passing variables incorrectly to execute.

Both values use %s placeholders, and the actual username variable user_name is passed as a parameter along with the password.