How SQL injection exploits queries - Practice Exercises

Challenge - 5 Problems

❓ query_result

intermediate

What is the output of this vulnerable SQL query?

Consider a web application that constructs this SQL query by directly inserting user input username without sanitization:

SELECT * FROM users WHERE username = 'user_input';

If the user inputs ' OR '1'='1, what will the query return?

SQL

SELECT * FROM users WHERE username = '' OR '1'='1';

A Returns only rows where username is exactly '' OR '1'='1'

B Returns no rows

C Raises a syntax error

D Returns all rows from the users table

💡 Hint

Think about how the OR condition affects the WHERE clause.

The injected OR condition '1'='1' is always true, so the WHERE clause matches all rows, returning the entire users table.

🧠 Conceptual

intermediate

Which part of this query is vulnerable to SQL injection?

Given this query construction in code:

query = "SELECT * FROM products WHERE category = '" + user_input + "';"

Which part allows SQL injection?

A Using single quotes around <code>user_input</code>

B Directly concatenating <code>user_input</code> into the query string

C Selecting from the products table

D Using the WHERE clause

💡 Hint

Consider how user input is included in the query.

Concatenating user input directly into the query string without sanitization or parameterization allows attackers to inject malicious SQL code.

📝 Syntax

advanced

Which option correctly prevents SQL injection using parameterized queries?

Choose the correct SQL query syntax using parameters to safely query a user by username.

A SELECT * FROM users WHERE username = ?;

B SELECT * FROM users WHERE username = '" + username + "';

C SELECT * FROM users WHERE username = username;

D SELECT * FROM users WHERE username = :username OR 1=1;

💡 Hint

Look for the syntax that uses placeholders for parameters.

Using ? as a placeholder allows safe binding of user input, preventing injection.

🔧 Debug

advanced

Why does this query allow SQL injection?

Examine this code snippet:

query = f"SELECT * FROM orders WHERE order_id = {order_id};"

Assuming order_id comes from user input, why is this vulnerable?

A Because order_id is an integer and cannot be injected

B Because the query uses double quotes instead of single quotes

C Because <code>order_id</code> is inserted directly without validation or parameterization

D Because the query is missing a semicolon

💡 Hint

Think about how user input is included in the query string.

Directly inserting user input into the query string without checks allows attackers to inject malicious SQL code.

❓ optimization

expert

Which approach best prevents SQL injection and improves query performance?

Given a web app querying user data by email, which option both prevents SQL injection and optimizes query execution?

A Use parameterized queries with an index on the email column

B Escape single quotes in user input and use string concatenation

C Use dynamic SQL with user input directly inserted

D Use a LIKE clause with wildcards around user input

💡 Hint

Consider both security and performance aspects.

Parameterized queries prevent injection, and indexing the email column speeds up lookups.