[Solved] Which SQL query is vulnerable to injection if user input is not sanitized?SELECT * FROM users WHERE username = '" + userInput + "'; | SQL

SQL - Security Basics

Which SQL query is vulnerable to injection if user input is not sanitized?

SELECT * FROM users WHERE username = '" + userInput + "';

ASELECT * FROM users WHERE username = '" + userInput + "';

BSELECT * FROM users WHERE username = 'admin';

CSELECT * FROM users WHERE username = ?;

DSELECT * FROM users WHERE username = $1;

Step-by-Step Solution

Solution:

Step 1: Analyze query construction
The query concatenates user input directly into the SQL string, which is unsafe.
Step 2: Compare with safe parameterized queries
Options C and D use placeholders, which prevent injection.
Final Answer:
SELECT * FROM users WHERE username = '" + userInput + "'; -> Option A
Quick Check:
Unsafe query = String concatenation with user input [OK]

Quick Trick: Avoid string concatenation for SQL queries [OK]

Common Mistakes:

Master "Security Basics" in SQL

9 interactive learning modes - each teaches the same concept differently

More SQL Quizzes

Which SQL query is vulnerable to injection if user input is not sanitized?