SQL injection prevention in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely execute a SQL query using Flask and SQLite.

Flask

cursor.execute("SELECT * FROM users WHERE username = ?", ([1],))

Drag options to blanks, or click blank then click option'

Ainput

Buser_input

Cusername

Dname

Attempts:

3 left

💡 Hint

Common Mistakes

Putting the user input directly into the query string.

Using string concatenation to build the query.

Using parameterized queries with placeholders like ? and passing the user input as a tuple prevents SQL injection.

2fill in blank

medium

Complete the code to fetch the first result safely after executing a parameterized query.

Flask

result = cursor.[1]()

Drag options to blanks, or click blank then click option'

Afetchall

Bfetchone

Cfetchmany

Dexecute

Attempts:

3 left

💡 Hint

Common Mistakes

Using execute() instead of a fetch method.

Using fetchall() when only one result is needed.

fetchone() retrieves the first row of the query result safely.

3fill in blank

hard

Fix the error in the code to prevent SQL injection when inserting data.

Flask

cursor.execute("INSERT INTO users (username, password) VALUES ([1], [2])", (username, password))

Drag options to blanks, or click blank then click option'

A?

C:username

D:password

Eusername

Fpassword

Attempts:

3 left

💡 Hint

Common Mistakes

Putting quotes around placeholders.

Using named placeholders without proper syntax.

Use ? placeholders without quotes and separate them by commas to safely insert parameters.

4fill in blank

hard

Fill both blanks to create a safe SELECT query with named placeholders in Flask.

Flask

cursor.execute("SELECT * FROM users WHERE email = [1]", [2])

Drag options to blanks, or click blank then click option'

A:email

B{'email': email}

Cemail

D('email',)

Attempts:

3 left

💡 Hint

Common Mistakes

Using positional placeholders with a dictionary.

Passing parameters as a tuple with named placeholders.

Named placeholders like :email are used in the query string, and a dictionary with the key 'email' maps to the variable email.

5fill in blank

hard

Fill all three blanks to safely update a user's password using parameterized queries.

Flask

cursor.execute("UPDATE users SET password = [1] WHERE username = [2]", ([3], username))

Drag options to blanks, or click blank then click option'

A?

B:password

Cnew_password

Dpassword

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing named and positional placeholders.

Passing variable names as strings instead of variables.

Use positional placeholders ? for both parameters and pass the new password variable in the tuple.