SQL injection prevention in Flask - Step-by-Step Execution

Concept Flow - SQL injection prevention

User Input Received

↓

Use Parameterized Query

↓

Database Query Executes

↓

Safe Data Returned

↓

Display Results to User

↓

END

The flow shows how user input is safely handled by using parameterized queries to prevent SQL injection.

Execution Sample

Flask

user_input = request.args.get('id')
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_input,))
result = cursor.fetchall()

This code safely queries the database using a parameterized query with user input.

Execution Table

Step	Action	Input/Condition	Query Sent to DB	Result
1	Receive user input	user_input = '1 OR 1=1'	N/A	N/A
2	Prepare parameterized query	query = "SELECT * FROM users WHERE id = %s"	SELECT * FROM users WHERE id = %s	N/A
3	Execute query with parameter	cursor.execute(query, ('1 OR 1=1',))	SELECT * FROM users WHERE id = '1 OR 1=1'	No injection, treated as string
4	Fetch results	cursor.fetchall()	N/A	Returns no user with id '1 OR 1=1' (likely none)
5	Display results	result	N/A	Safe output shown to user

💡 Execution stops after safely fetching and displaying results without injection.

Variable Tracker

Variable	Start	After Step 1	After Step 3	Final
user_input	None	'1 OR 1=1'	'1 OR 1=1'	'1 OR 1=1'
query	None	"SELECT * FROM users WHERE id = %s"	"SELECT * FROM users WHERE id = %s"	"SELECT * FROM users WHERE id = %s"
result	None	None	None	[] or safe user data

Key Moments - 2 Insights

Why doesn't the input '1 OR 1=1' cause the query to return all users?

Because the input is passed as a parameter, the database treats it as a string value, not as SQL code, so no injection happens (see execution_table step 3).

What happens if we concatenate user input directly into the query string?

Direct concatenation would let the input be interpreted as SQL code, causing injection. Parameterized queries prevent this by separating code from data.

Visual Quiz - 3 Questions

Look at the execution table at step 3, what does the database see as the query?

A SELECT * FROM users WHERE id = '1 OR 1=1'

B SELECT * FROM users WHERE id = %s

C SELECT * FROM users WHERE id = 1 OR 1=1

D SELECT * FROM users

💡 Hint

Check the 'Query Sent to DB' column in step 3 of the execution table.

At which step is the user input first used in the query execution?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look at the 'Action' column to see when cursor.execute is called.

If user_input was concatenated directly into the query string, what would change in the execution table?

A The query would remain parameterized

B The result would be empty always

C The query sent to DB would include the raw input without quotes

D The input would be ignored

💡 Hint

Think about how direct string concatenation affects the query in step 3.

Concept Snapshot

SQL Injection Prevention in Flask:
- Always use parameterized queries with placeholders like %s
- Pass user inputs as parameters, not by string concatenation
- This keeps user input as data, not executable code
- Prevents attackers from injecting harmful SQL
- Use cursor.execute(query, (user_input,)) pattern
- Always validate and sanitize inputs additionally

Full Transcript

This visual execution trace shows how SQL injection is prevented in Flask by using parameterized queries. User input is received as a string, then passed safely as a parameter to the database query. The database treats the input as data, not code, so malicious inputs like '1 OR 1=1' do not alter the query logic. The execution table walks through each step: receiving input, preparing the query, executing with parameters, fetching results, and displaying them safely. Variable tracking shows how user_input and query remain unchanged as code, and result holds safe data. Key moments clarify why parameterization stops injection and why direct concatenation is dangerous. The quiz tests understanding of query formation and execution steps. The snapshot summarizes best practices for preventing SQL injection in Flask applications.