SQL injection and XSS prevention in HLD - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding SQL Injection Risks

Which of the following best describes how SQL injection attacks occur?

A When the database server crashes due to high traffic

B When the user inputs are sanitized before being processed

C When the application uses encrypted connections to the database

D When user input is directly included in SQL queries without proper validation or escaping

💡 Hint

Think about how attackers can manipulate queries by inserting malicious code.

SQL injection happens when user inputs are inserted directly into SQL statements without proper handling, allowing attackers to alter the query logic.

❓ Architecture

intermediate

Designing Input Validation for XSS Prevention

Which design approach is most effective to prevent Cross-Site Scripting (XSS) attacks in a web application?

A Sanitize and encode all user inputs before rendering them in the browser

B Allow all HTML tags in user inputs to support rich text

C Store raw user inputs and sanitize only on the database side

D Disable JavaScript in the browser to prevent script execution

💡 Hint

Consider where and how user inputs are displayed in the browser.

Sanitizing and encoding user inputs before rendering prevents malicious scripts from executing in the browser, effectively stopping XSS attacks.

❓ scaling

advanced

Scaling Secure Input Validation in Distributed Systems

In a distributed web application with multiple microservices, what is the best practice to ensure consistent SQL injection and XSS prevention?

A Rely on the database engine to prevent injection and XSS

B Let each microservice implement its own input validation independently

C Implement centralized input validation and sanitization service used by all microservices

D Validate inputs only at the frontend client side

💡 Hint

Think about consistency and maintainability across services.

Centralizing input validation ensures uniform security policies and reduces duplication, making it easier to maintain and update protections.

❓ tradeoff

advanced

Tradeoffs in Using Parameterized Queries vs. ORM for SQL Injection Prevention

Which statement correctly describes a tradeoff between using parameterized queries and Object-Relational Mapping (ORM) frameworks for preventing SQL injection?

A Parameterized queries provide fine-grained control and are less abstract, but ORMs simplify development with built-in protections

B ORMs always produce faster queries than parameterized queries

C Parameterized queries cannot prevent SQL injection without additional sanitization

D ORMs require manual escaping of all inputs to prevent injection

💡 Hint

Consider control versus convenience in query building.

Parameterized queries allow precise control over SQL statements, while ORMs abstract query building and include automatic protections, but may add complexity.

❓ estimation

expert

Estimating Impact of Input Validation on System Performance

A web application adds comprehensive input validation and sanitization to prevent SQL injection and XSS. Which estimation best describes the expected impact on system performance under heavy load?

A A large increase in memory usage causing frequent crashes

B A small increase in CPU usage due to validation logic, generally negligible compared to network and database latency

C No impact at all since validation happens instantly

D A significant slowdown because validation requires database queries for every input

💡 Hint

Think about where validation happens and what resources it uses.

Input validation uses CPU cycles but is usually lightweight compared to other system operations like network calls and database queries, so performance impact is small.

Practice

1. Which of the following is the best way to prevent SQL injection attacks in a web application?

easy

A. Escape HTML tags in user input

B. Use parameterized queries or prepared statements

C. Disable JavaScript in the browser

D. Use client-side validation only

Solution

1. Step 1: Understand SQL injection cause

   SQL injection happens when user input is directly included in SQL queries without safe handling.

2. Step 2: Identify prevention method

   Parameterized queries separate code from data, preventing attackers from injecting SQL commands.

3. Final Answer:

   Use parameterized queries or prepared statements -> Option B

4. Quick Check:

   SQL injection prevention = parameterized queries [OK]

Hint: Always separate code and data with parameterized queries [OK]

Common Mistakes:

• Relying only on client-side validation
• Escaping HTML instead of SQL input
• Disabling JavaScript does not stop SQL injection

2. Which syntax correctly uses a parameterized query to prevent SQL injection in a typical SQL library?

easy

A. cursor.execute('SELECT * FROM users WHERE name = ?', (user_input,))

B. cursor.execute('SELECT * FROM users WHERE name = ' + user_input)

C. cursor.execute(f'SELECT * FROM users WHERE name = {user_input}')

D. cursor.execute('SELECT * FROM users WHERE name = ' + str(user_input))

Solution

1. Step 1: Identify parameterized query syntax

   Parameterized queries use placeholders like '?' and pass parameters separately to avoid injection.

2. Step 2: Check each option

   cursor.execute('SELECT * FROM users WHERE name = ?', (user_input,)) uses '?' placeholder and passes parameters as a tuple, which is correct syntax.

3. Final Answer:

   cursor.execute('SELECT * FROM users WHERE name = ?', (user_input,)) -> Option A

4. Quick Check:

   Parameterized query syntax = cursor.execute('SELECT * FROM users WHERE name = ?', (user_input,)) [OK]

Hint: Look for placeholders and separate parameter tuple [OK]

Common Mistakes:

• Concatenating strings directly with user input
• Using f-strings without sanitization
• Passing parameters inside the query string

3. Given the following code snippet, what will be the output if user_input = "" and the output is rendered in HTML without escaping?

def render_comment(user_input):
    return f"<p>{user_input}</p>"

print(render_comment(user_input))

medium

A. SyntaxError due to unescaped quotes

B. <p>&lt;script&gt;alert('XSS')&lt;/script&gt;</p> (script shown as text)

C. <p><script>alert('XSS')</script></p> (script runs in browser)

D. Empty output because script tags are removed

Solution

1. Step 1: Understand output without escaping

   The function inserts raw user input inside paragraph tags without escaping HTML special characters.

2. Step 2: Predict browser behavior

   Browser interprets <script> tags and runs the alert, causing an XSS attack.

3. Final Answer:

   <p><script>alert('XSS')</script></p> (script runs in browser) -> Option C

4. Quick Check:

   Unescaped HTML input = script runs [OK]

Hint: Unescaped HTML input allows scripts to run [OK]

Common Mistakes:

• Assuming script tags are automatically escaped
• Confusing HTML escaping with SQL escaping
• Expecting syntax errors from user input

4. A developer wrote this code to prevent XSS:

def safe_render(user_input):
    return f"<p>{user_input.replace('<', '<').replace('>', '>')}</p>"

But users report that some scripts still run. What is the likely cause?

medium

A. The replace method does not work on strings

B. The function should remove all HTML tags instead of replacing

C. The code should use double quotes instead of single quotes

D. Only replacing < and > is insufficient; other characters like quotes must be escaped

Solution

1. Step 1: Analyze current escaping

   The code replaces only < and > but leaves quotes and other characters unescaped.

2. Step 2: Understand XSS vectors

   Attackers can use quotes or other entities to break out of attributes or inject scripts.

3. Final Answer:

   Only replacing < and > is insufficient; other characters like quotes must be escaped -> Option D

4. Quick Check:

   Partial escaping = incomplete XSS prevention [OK]

Hint: Escape all special HTML chars, not just < and > [OK]

Common Mistakes:

• Thinking replacing < and > is enough
• Believing string replace fails silently
• Ignoring quotes and ampersands in input

5. You are designing a web app that stores user comments and displays them safely. Which combination of techniques best prevents both SQL injection and XSS attacks?

hard

A. Use parameterized queries for database and escape HTML output with a Content Security Policy (CSP)

B. Sanitize user input by removing all special characters before storing

C. Use client-side JavaScript to validate input and disable scripts in browser settings

D. Store raw input and rely on HTTPS to secure data transmission

Solution

1. Step 1: Prevent SQL injection

   Use parameterized queries to safely handle user input in database commands.

2. Step 2: Prevent XSS attacks

   Escape HTML output when rendering user content and enforce a Content Security Policy to restrict script execution.

3. Final Answer:

   Use parameterized queries for database and escape HTML output with a Content Security Policy (CSP) -> Option A

4. Quick Check:

   SQL injection + XSS prevention = parameterized queries + escaping + CSP [OK]

Hint: Combine safe DB queries with output escaping and CSP [OK]

Common Mistakes:

• Removing all special characters breaks user input
• Relying only on client-side validation
• Ignoring output escaping and security headers