Query parameterization for safety in Node.js - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely insert a user ID into the SQL query using parameterization.

Node.js

const userId = 5;
const query = "SELECT * FROM users WHERE id = [1]";

Drag options to blanks, or click blank then click option'

A?

B$1

C:id

D@userId

Attempts:

3 left

💡 Hint

Common Mistakes

Using string concatenation instead of placeholders.

Using raw variables directly in the query string.

Using ? is the standard placeholder for parameterized queries in many Node.js SQL libraries like sqlite3 or mysql.

2fill in blank

medium

Complete the code to pass the user ID as a parameter to the query execution function.

Node.js

db.query("SELECT * FROM users WHERE id = ?", [1], (err, results) => {
  if (err) throw err;
  console.log(results);
});

Drag options to blanks, or click blank then click option'

AuserId

B{userId}

C"userId"

D[userId]

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the parameter as a single value instead of an array.

Passing the parameter as a string instead of a variable.

The parameters must be passed as an array to match the placeholders in the query.

3fill in blank

hard

Fix the error in the code by completing the parameterized query syntax for PostgreSQL using node-postgres.

Node.js

const userId = 10;
const query = "SELECT * FROM users WHERE id = [1]";
client.query(query, [userId], (err, res) => {
  if (err) throw err;
  console.log(res.rows);
});

Drag options to blanks, or click blank then click option'

A?

B$1

C:userId

D@id

Attempts:

3 left

💡 Hint

Common Mistakes

Using ? placeholder which is not supported by node-postgres.

Using named placeholders which are not supported in this context.

PostgreSQL with node-postgres uses numbered placeholders like $1 for parameterized queries.

4fill in blank

hard

Fill both blanks to safely update a user's email using parameterized query with mysql2 library.

Node.js

const userId = 7;
const newEmail = "[e-mail]";
const query = "UPDATE users SET email = [1] WHERE id = [2]";
db.execute(query, [newEmail, userId], (err, results) => {
  if (err) throw err;
  console.log(results);
});

Drag options to blanks, or click blank then click option'

A?

B$1

C:email

D@id

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing different placeholder styles in the same query.

Using named placeholders which mysql2 does not support.

MySQL libraries like mysql2 use ? as placeholders for all parameters in the query.

5fill in blank

hard

Fill all three blanks to safely select users by status and age using parameterized query with node-postgres.

Node.js

const status = 'active';
const minAge = 18;
const maxAge = 30;
const query = `SELECT * FROM users WHERE status = [1] AND age >= [2] AND age <= [3]`;
client.query(query, [status, minAge, maxAge], (err, res) => {
  if (err) throw err;
  console.log(res.rows);
});

Drag options to blanks, or click blank then click option'

A?

B$1

C$3

D$2

Attempts:

3 left

💡 Hint

Common Mistakes

Using ? placeholders with node-postgres.

Numbering placeholders out of order.

PostgreSQL uses numbered placeholders $1, $2, $3 matching the order of parameters.