How SQL injection exploits unsafe queries in PHP - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to get the user input safely.

PHP

<?php
$username = $_GET[[1]];
?>

Drag options to blanks, or click blank then click option'

Ausername

B"user"

C'user'

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Not using quotes around the key name causes a syntax error.

Using single quotes inside single quotes without escaping.

The user input is accessed via the $_GET superglobal with the key as a string, so it must be quoted.

2fill in blank

medium

Complete the code to build an unsafe SQL query using the user input.

PHP

<?php
$query = "SELECT * FROM users WHERE username = '[1]'";
?>

Drag options to blanks, or click blank then click option'

A$username

Busername

C'$username'

D"$username"

Attempts:

3 left

💡 Hint

Common Mistakes

Using the variable name without $ sign.

Adding extra quotes around the variable causing syntax errors.

The variable $username should be inserted directly inside the string with single quotes around it in the SQL query.

3fill in blank

hard

Fix the error in the unsafe query that allows SQL injection.

PHP

<?php
$query = "SELECT * FROM users WHERE username = '" . [1] . "'";
?>

Drag options to blanks, or click blank then click option'

Amysqli_real_escape_string($conn, $username)

B$username

Caddslashes($username)

Dhtmlspecialchars($username)

Attempts:

3 left

💡 Hint

Common Mistakes

Using htmlspecialchars which is for HTML, not SQL.

Not escaping the input at all.

Using mysqli_real_escape_string escapes special characters to prevent SQL injection.

4fill in blank

hard

Fill both blanks to prepare and execute a safe SQL statement.

PHP

<?php
$stmt = $conn->prepare("SELECT * FROM users WHERE username = [1]");
$stmt->bind_param([2], $username);
$stmt->execute();
?>

Drag options to blanks, or click blank then click option'

A?

B"s"

Cs

D'?'

Attempts:

3 left

💡 Hint

Common Mistakes

Using quotes around the placeholder or type causes errors.

Using the wrong placeholder symbol.

The placeholder in the SQL statement is a question mark ?. The bind_param type for a string is s without quotes.

5fill in blank

hard

Fill all three blanks to fetch and display safe query results.

PHP

<?php
$stmt = $conn->prepare("SELECT email FROM users WHERE username = [1]");
$stmt->bind_param([2], $username);
$stmt->bind_result([3]);
$stmt->execute();
$stmt->fetch();
echo $email;
?>

Drag options to blanks, or click blank then click option'

A?

Bs

C$email

D"s"

Attempts:

3 left

💡 Hint

Common Mistakes

Using quotes around the bind_param type.

Not using a variable with $ in bind_result.

The placeholder is ?, the bind_param type is s, and the variable to bind the result is $email.