SQL injection prevention in Flask - Mini Project: Build & Apply

Prevent SQL Injection in a Flask App

📖 Scenario: You are building a simple Flask web app that lets users search for books by title.To keep the app safe, you want to prevent SQL injection attacks.

🎯 Goal: Build a Flask app that safely queries a SQLite database using parameterized queries to prevent SQL injection.

📋 What You'll Learn

Create a SQLite database connection

Write a SQL query with a parameter placeholder

Use Flask request to get user input

Use parameterized queries to safely pass user input

Return query results in the Flask route

💡 Why This Matters

🌍 Real World

Web apps often take user input to query databases. Preventing SQL injection keeps user data and servers safe.

💼 Career

Understanding how to safely query databases is essential for backend web developers and security-conscious programmers.

1

Set up the Flask app and database connection

Import Flask and sqlite3. Create a Flask app called app. Define a function get_db_connection() that returns a connection to a SQLite database file named books.db.

Flask

# Your code here

Hint

Use Flask(__name__) to create the app. Use sqlite3.connect with the exact filename 'books.db'.

2

Add a route to get the search term from the user

Import request from flask. Add a route /search with a function search(). Inside search(), get the query parameter title from request.args and store it in a variable called title.

Flask

from flask import Flask, request
import sqlite3

app = Flask(__name__)

def get_db_connection():
    conn = sqlite3.connect('books.db')
    conn.row_factory = sqlite3.Row
    return conn

@app.route('/search')
def search():
    # Your code here

Hint

Use request.args.get('title') to get the search term from the URL query string.

3

Query the database safely using parameterized queries

Inside the search() function, get a database connection by calling get_db_connection(). Use conn.execute() with a SQL query string "SELECT * FROM books WHERE title LIKE ?" and pass a tuple with f"%{title}%" as the parameter. Store the result in a variable called books. Then fetch all rows with books.fetchall().

Flask

from flask import Flask, request
import sqlite3

app = Flask(__name__)

def get_db_connection():
    conn = sqlite3.connect('books.db')
    conn.row_factory = sqlite3.Row
    return conn

@app.route('/search')
def search():
    title = request.args.get('title')
    # Your code here

Hint

Use a question mark ? as a placeholder in the SQL query. Pass the parameter as a tuple with f"%{title}%" to search titles containing the input.

4

Return the search results as a simple string

Still inside search(), close the database connection with conn.close(). Return a string that joins all book titles separated by commas using ','.join(book['title'] for book in books).

Flask

from flask import Flask, request
import sqlite3

app = Flask(__name__)

def get_db_connection():
    conn = sqlite3.connect('books.db')
    conn.row_factory = sqlite3.Row
    return conn

@app.route('/search')
def search():
    title = request.args.get('title')
    conn = get_db_connection()
    books = conn.execute("SELECT * FROM books WHERE title LIKE ?", (f"%{title}%",))
    books = books.fetchall()
    # Your code here

Hint

Close the connection before returning. Use a generator expression to join titles with commas.

Practice

1. What is the main purpose of using parameterized queries in Flask when working with databases?

easy

A. To speed up database queries by caching results

B. To prevent SQL injection attacks by separating code from data

C. To allow users to write their own SQL commands

D. To automatically create database tables

Solution

1. Step 1: Understand SQL injection risk

   SQL injection happens when user input is treated as code, allowing attackers to change database commands.

2. Step 2: Role of parameterized queries

   Parameterized queries keep user data separate from SQL code, stopping attackers from injecting harmful commands.

3. Final Answer:

   To prevent SQL injection attacks by separating code from data -> Option B

4. Quick Check:

   SQL injection prevention = parameterized queries [OK]

Hint: Remember: separate data from code to stop injection [OK]

Common Mistakes:

• Thinking parameterized queries speed up queries
• Believing users can safely write SQL commands
• Confusing parameterized queries with table creation

2. Which of the following is the correct way to use parameterized queries with Flask's database cursor?

easy

A. cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

B. cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

C. cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

D. cursor.execute("SELECT * FROM users WHERE id = :id", user_id)

Solution

1. Step 1: Identify correct placeholder syntax

   In Flask with many DB adapters like psycopg2, %s is used as placeholder for parameters.

2. Step 2: Check parameter passing format

   Parameters must be passed as a tuple, e.g., (user_id,). cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,)) uses %s and tuple correctly.

3. Final Answer:

   cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,)) -> Option C

4. Quick Check:

   Use %s with tuple for parameters [OK]

Hint: Use %s and tuple for parameters in execute() [OK]

Common Mistakes:

• Using f-strings directly with user input
• Using ? placeholder which is for SQLite, not psycopg2
• Passing parameters incorrectly without tuple

3. Given this Flask code snippet, what will be the output if user_id = "1 OR 1=1" and parameterized queries are used correctly?

cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
results = cursor.fetchall()
print(results)

medium

A. Only rows where id equals the string '1 OR 1=1' will be returned

B. All rows from users table will be returned

C. Syntax error due to SQL injection

D. No rows will be returned because of wrong query

Solution

1. Step 1: Understand parameterized query effect

   Parameterized queries treat user input as data, not code, so "1 OR 1=1" is a string value, not SQL logic.

2. Step 2: Result of query with injected string

   The query looks for rows where id equals the string "1 OR 1=1", which likely matches no rows or only exact matches.

3. Final Answer:

   Only rows where id equals the string '1 OR 1=1' will be returned -> Option A

4. Quick Check:

   Parameterized input treated as data = Only rows where id equals the string '1 OR 1=1' will be returned [OK]

Hint: Parameterized input is data, not code, so no injection [OK]

Common Mistakes:

• Assuming injection runs and returns all rows
• Expecting syntax error from parameterized query
• Thinking query fails due to input format

4. Identify the error in this Flask code that tries to prevent SQL injection:

user_id = request.args.get('id')
cursor.execute("SELECT * FROM users WHERE id = %s" % user_id)
results = cursor.fetchall()

medium

A. Using wrong placeholder %s instead of ?

B. Missing parentheses in fetchall()

C. Not converting user_id to integer

D. Using string formatting instead of parameterized query

Solution

1. Step 1: Check how query is constructed

   The code uses string formatting (% operator) to insert user_id directly into the query string.

2. Step 2: Why this is wrong for injection prevention

   Direct string formatting allows malicious input to change SQL code, causing SQL injection risk.

3. Final Answer:

   Using string formatting instead of parameterized query -> Option D

4. Quick Check:

   Use parameterized queries, not string formatting [OK]

Hint: Never build queries with string formatting; use parameters [OK]

Common Mistakes:

• Thinking fetchall() needs parentheses fix
• Believing user_id must be int for injection safety
• Confusing %s and ? placeholders

5. You want to safely insert multiple user records into a database using Flask and prevent SQL injection. Which approach correctly combines parameterized queries with batch insertion?

users = [("alice", 25), ("bob", 30)]
cursor.executemany(??? , users)

What should replace ????

hard

A. "INSERT INTO users (name, age) VALUES (%s, %s)"

B. "INSERT INTO users (name, age) VALUES ('%s', '%s')"

C. "INSERT INTO users (name, age) VALUES (?, ?)"

D. "INSERT INTO users (name, age) VALUES (:name, :age)"

Solution

1. Step 1: Identify correct placeholder syntax for batch insert

   For executemany with psycopg2 or similar, %s placeholders are used without quotes.

2. Step 2: Check placeholder usage in options

   "INSERT INTO users (name, age) VALUES (%s, %s)" uses %s placeholders correctly; "INSERT INTO users (name, age) VALUES ('%s', '%s')" wrongly adds quotes, "INSERT INTO users (name, age) VALUES (?, ?)" uses ? (SQLite style), "INSERT INTO users (name, age) VALUES (:name, :age)" uses named placeholders which need dicts.

3. Final Answer:

   "INSERT INTO users (name, age) VALUES (%s, %s)" -> Option A

4. Quick Check:

   Use %s placeholders without quotes for executemany [OK]

Hint: Use %s placeholders without quotes for batch inserts [OK]

Common Mistakes:

• Adding quotes around %s placeholders
• Using ? placeholders with psycopg2
• Using named placeholders without dict parameters