Flask - Security Best Practices
What will happen if you use string concatenation to build a SQL query in Flask like this?
```python
query = "SELECT * FROM users WHERE username = '" + username + "'"
cursor.execute(query)
```
What will happen if you use string concatenation to build a SQL query in Flask like this? ```python query = "SELECT * FROM users WHERE username = '" + username + "'" cursor.execute(query) ```
medium📝 Predict Output Q5 of 15
Step-by-Step Solution
Solution:
Step 1: Analyze string concatenation risk
Concatenating user input directly allows injection of SQL code.Step 2: Understand Flask's behavior
Flask does not sanitize input automatically; risk remains.Final Answer:
It may cause SQL injection if username is malicious -> Option BQuick Check:
Direct concatenation = injection risk = D [OK]
Quick Trick: Never build SQL queries by concatenating user input [OK]
Common Mistakes:
MISTAKES- Assuming Flask sanitizes input automatically
- Ignoring injection risks
Master "Security Best Practices" in Flask
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore Flask Quizzes