SQL injection protection via ORM in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely filter users by username using Django ORM.

Django

users = User.objects.filter(username=[1])

Drag options to blanks, or click blank then click option'

Araw_sql

Busername

C"john"

DUser.username

Attempts:

3 left

💡 Hint

Common Mistakes

Using raw SQL strings directly in filter

Passing variable names without quotes

The Django ORM safely handles string values in filter to prevent SQL injection.

2fill in blank

medium

Complete the code to safely get a user by id using Django ORM.

Django

user = User.objects.get(id=[1])

Drag options to blanks, or click blank then click option'

A42

Buser_id

C"42"

Did

Attempts:

3 left

💡 Hint

Common Mistakes

Passing unescaped strings

Using raw SQL in get()

Passing an integer literal directly is safe and prevents injection.

3fill in blank

hard

Complete the code to safely filter users by email using Django ORM.

Django

users = User.objects.filter(email=[1])

Drag options to blanks, or click blank then click option'

Arequest.GET['email']

Brequest.GET.get('email')

Cf"{request.GET['email']}"

D"[e-mail]"

Attempts:

3 left

💡 Hint

Common Mistakes

Using undefined variables like request.GET['email']

Using f-strings with undefined variables

Using a string literal in the ORM filter is safe against SQL injection because the ORM automatically parameterizes queries.

4fill in blank

hard

Fill both blanks to safely filter users with age greater than 18 and username equals 'alice'.

Django

users = User.objects.filter(age__[1]=18, username=[2])

Drag options to blanks, or click blank then click option'

Agt

Blt

C"alice"

D"bob"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'lt' instead of 'gt'

Not quoting string values

Use 'gt' for greater than and a quoted string for username to prevent injection.

5fill in blank

hard

Fill all three blanks to create a safe query that excludes users with is_active False, filters by last_name 'Smith', and orders by 'date_joined'.

Django

users = User.objects.exclude(is_active=[1]).filter(last_name=[2]).order_by([3])

Drag options to blanks, or click blank then click option'

AFalse

B"Smith"

C"date_joined"

DTrue

Attempts:

3 left

💡 Hint

Common Mistakes

Quoting boolean values

Passing unquoted field names to order_by

Use boolean False without quotes, quote string values, and pass field names as strings to order_by.