How SQL injection exploits queries - Try It Yourself

Understanding How SQL Injection Exploits Queries

📖 Scenario: You are a junior database administrator learning about security risks in SQL queries. Your task is to see how unsafe SQL queries can be exploited by attackers using SQL injection.Imagine a website login form where users enter their username and password. The backend uses SQL queries to check if the user exists and the password matches.

🎯 Goal: Build a simple SQL query that selects users by username and password. Then, see how an attacker can exploit this query by injecting malicious input. Finally, learn how to fix the query to prevent SQL injection.

📋 What You'll Learn

Create a SQL query string that selects from a users table using username and password variables

Add a variable for user input that simulates an attacker injecting SQL code

Write the unsafe query that concatenates user input directly into the SQL string

Write a safe query using parameter placeholders to prevent SQL injection

💡 Why This Matters

🌍 Real World

Web applications often take user input and use it in database queries. Understanding SQL injection helps prevent attackers from stealing or damaging data.

💼 Career

Database administrators and developers must write secure queries to protect sensitive information and maintain trust.

1

Create user input variables

Create two variables called username and password with these exact values: 'admin' for username and '1234' for password.

SQL

# Create variables username and password with exact values
# Your code here

Need a hint?

Use simple assignment statements to create the variables.

2

Add attacker input variable

Create a variable called attacker_input with this exact value: "' OR '1'='1" to simulate an SQL injection attack string.

SQL

username = 'admin'
password = '1234'
# Create attacker_input variable with SQL injection string
# Your code here

Need a hint?

Use double quotes outside and single quotes inside the string to match exactly.

3

Write unsafe SQL query using string concatenation

Create a variable called unsafe_query that builds this SQL string exactly by concatenating username and password variables: "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'".

SQL

username = 'admin'
password = '1234'
attacker_input = "' OR '1'='1"
# Create unsafe_query by concatenating username and password into SQL string
# Your code here

Need a hint?

Use string concatenation with + operator and include single quotes around variables inside the SQL string.

4

Write safe SQL query using parameter placeholders

Create a variable called safe_query with this exact value: "SELECT * FROM users WHERE username = ? AND password = ?" to show how to safely write SQL queries using placeholders.

SQL

username = 'admin'
password = '1234'
attacker_input = "' OR '1'='1"
unsafe_query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'"
# Create safe_query using parameter placeholders
# Your code here

Need a hint?

Use question marks as placeholders for parameters in the SQL string.