SQL injection and XSS prevention in HLD - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to use parameterized queries to prevent SQL injection.

HLD

cursor.execute("SELECT * FROM users WHERE username = [1]", (username,))

Drag options to blanks, or click blank then click option'

A"username"

B"'" + username + "'"

C"%s"

D"?"

Attempts:

3 left

💡 Hint

Common Mistakes

Concatenating user input directly into SQL query.

Using %s as a placeholder in parameterized queries safely inserts user input, preventing SQL injection.

2fill in blank

medium

Complete the code to sanitize user input to prevent XSS attacks.

HLD

safe_input = [1](user_input)

Drag options to blanks, or click blank then click option'

Asanitize_sql

Bescape_html

Cstrip_tags

Dencode_url

Attempts:

3 left

💡 Hint

Common Mistakes

Using SQL sanitization functions for XSS prevention.

Escaping HTML special characters prevents malicious scripts from running in the browser, thus preventing XSS.

3fill in blank

hard

Fix the error in the code to properly prevent SQL injection.

HLD

query = "SELECT * FROM products WHERE id = " + [1]
cursor.execute(query, (product_id,))

Drag options to blanks, or click blank then click option'

Aproduct_id

B"%s" % product_id

Cstr(product_id)

D"%s"

Attempts:

3 left

💡 Hint

Common Mistakes

Concatenating user input directly into query string.

Directly concatenating user input causes SQL injection risk. Use a placeholder and parameterized query instead.

4fill in blank

hard

Fill both blanks to create a secure web form input handling that prevents XSS and SQL injection.

HLD

safe_username = [1](request.form['username'])
query = "INSERT INTO users (username) VALUES ([2])"

Drag options to blanks, or click blank then click option'

Aescape_html

B"%s"

Csanitize_sql

Duser_input

Attempts:

3 left

💡 Hint

Common Mistakes

Not escaping HTML input.

Not using parameterized queries.

Escape HTML to prevent XSS and use parameter placeholder %s to prevent SQL injection.

5fill in blank

hard

Fill all three blanks to implement a safe data flow from user input to database insertion preventing SQL injection and XSS.

HLD

clean_input = [1](user_input)
query = "UPDATE profiles SET bio = [2] WHERE user_id = [3]"
cursor.execute(query, (clean_input, user_id))

Drag options to blanks, or click blank then click option'

Aescape_html

B"%s"

Dsanitize_sql

Attempts:

3 left

💡 Hint

Common Mistakes

Not escaping HTML input.

Using string concatenation in SQL queries.

Escape HTML to prevent XSS, and use %s placeholders for SQL parameters to prevent injection.