SQL injection prevention in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use parameterized queries in Flask?

Which of the following best explains why parameterized queries help prevent SQL injection attacks in Flask applications?

A They automatically sanitize HTML output to prevent script injection.

B They encrypt the database connection to block attackers.

C They separate SQL code from data, so user input cannot change the query structure.

D They limit the number of database connections to prevent overload.

💡 Hint

Think about how user input is handled inside the SQL command.

Parameterized queries keep the SQL code and user data separate. This means user input is treated only as data, not as part of the SQL command, preventing attackers from injecting harmful SQL.

❓ component_behavior

intermediate

Output of unsafe query with user input

Consider this Flask code snippet using raw string formatting for SQL:

user_id = "1 OR 1=1"
query = f"SELECT * FROM users WHERE id = {user_id}"
cursor.execute(query)
result = cursor.fetchall()

What will result contain?

A Only the row with id = 1, because the input is treated as a string.

B All rows from the users table, because the condition always evaluates to true.

C An empty list, because the query is invalid.

D A syntax error is raised due to improper query formatting.

💡 Hint

Look at how the user input changes the WHERE clause.

The input "1 OR 1=1" makes the WHERE clause always true, so all rows are returned. This shows why raw string formatting is dangerous.

📝 Syntax

advanced

Correct parameterized query syntax in Flask

Which of the following Flask code snippets correctly uses parameterized queries to safely select a user by id?

A cursor.execute("SELECT * FROM users WHERE id = :user_id", {'user_id': user_id})

B cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

C cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

D cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

💡 Hint

Check the parameter style and how parameters are passed as a tuple.

Option D uses the correct placeholder %s and passes parameters as a tuple. Option D is unsafe string formatting. Option D passes parameter correctly as a tuple but the placeholder ? is not used by all DB-API drivers in Flask (depends on the database). Option D uses named style but passes parameter incorrectly (should be a dict).

🔧 Debug

advanced

Identify the error in parameterized query usage

What error will this Flask code raise?

user_id = 5
cursor.execute("SELECT * FROM users WHERE id = ?", user_id)

A TypeError because parameters must be in a sequence like a tuple or list.

B SyntaxError due to missing quotes around the placeholder.

C OperationalError because the placeholder ? is invalid in this database.

D No error; the query runs successfully.

💡 Hint

Look at how parameters are passed to execute.

The parameter must be passed as a tuple or list, even if it is a single value. Passing a single integer causes a TypeError.

❓ state_output

expert

Result of mixed safe and unsafe query parts

Given this Flask code:

user_input = "1; DROP TABLE users;"
query = "SELECT * FROM users WHERE id = " + user_input
cursor.execute(query)
rows = cursor.fetchall()

What will happen when this code runs?

A A syntax error occurs because multiple statements are not allowed in one execute call.

B The database executes the SELECT and then drops the users table, causing data loss.

C Only the SELECT runs safely; the DROP TABLE is ignored by the database.

D The query returns no rows but the users table remains intact.

💡 Hint

Consider how the database driver handles multiple SQL statements in one execute.

Most database drivers do not allow multiple statements in one execute call, so this raises a syntax or operational error, preventing the DROP TABLE from running.