SQL injection prevention in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is SQL injection?

SQL injection is a security problem where an attacker adds harmful SQL code into input fields to trick the database into doing things it shouldn't, like revealing or changing data.

beginner

How does using parameterized queries help prevent SQL injection in Flask?

Parameterized queries keep user input separate from the SQL code. This means the database treats input only as data, not as commands, stopping attackers from changing the query's meaning.

intermediate

What Flask extension is commonly used to safely interact with databases and prevent SQL injection?

Flask-SQLAlchemy is a popular extension that helps write safe database queries using an object-oriented style, which automatically handles input safely to avoid SQL injection.

beginner

Why should you avoid building SQL queries by directly adding user input strings in Flask?

Directly adding user input to SQL queries can let attackers insert harmful commands. This is unsafe because the database runs whatever code it receives, including bad commands.

intermediate

What is an example of a safe way to query a database in Flask using parameterized queries?

Using Flask's database cursor with placeholders like: cursor.execute('SELECT * FROM users WHERE name = %s', (username,)) safely inserts the username without risk of injection.

What is the main risk of SQL injection?

A Attackers can run harmful SQL commands through user input

B The database runs faster

C User input is ignored

D The website loads slower

SQL injection lets attackers add harmful commands that the database will run.

Which method helps prevent SQL injection in Flask?

A Using plain text files instead of databases

B Concatenating strings to build queries

C Ignoring user input

D Using parameterized queries with placeholders

Parameterized queries keep user input separate from SQL code, preventing injection.

What does Flask-SQLAlchemy provide to help with SQL injection?

A A way to write raw SQL strings only

B An object-oriented way to build safe queries

C A tool to speed up the database

D A method to disable user input

Flask-SQLAlchemy lets you write queries as Python objects, which safely handle input.

Why is directly adding user input to SQL queries dangerous?

A It makes the code shorter

B It improves database security

C It can let attackers change the query meaning

D It prevents errors

Direct input can let attackers insert harmful SQL commands.

Which of these is a safe example of querying a database in Flask?

A cursor.execute('SELECT * FROM users WHERE name = %s', (username,))

B cursor.execute(f'SELECT * FROM users WHERE name = '{username}'')

C cursor.execute('SELECT * FROM users WHERE name = ' + username)

D cursor.execute('SELECT * FROM users')

Using placeholders (%s) with parameters safely inserts user input.

Explain how parameterized queries prevent SQL injection in Flask applications.

Think about how the database sees the input versus the command.

Describe why directly inserting user input into SQL queries is unsafe and how Flask-SQLAlchemy helps avoid this problem.

Consider how Flask-SQLAlchemy changes the way queries are written.