Why SQL security awareness matters - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to select all columns from the users table.

SQL

SELECT [1] FROM users;

Drag options to blanks, or click blank then click option'

AEVERY

BCOLUMNS

CALL

D*

Attempts:

3 left

💡 Hint

Common Mistakes

Using keywords like ALL or COLUMNS which are not valid here.

The asterisk (*) selects all columns from the table.

2fill in blank

medium

Complete the code to filter users with admin role.

SQL

SELECT * FROM users WHERE role = [1];

Drag options to blanks, or click blank then click option'

Aadmin

B'admin'

C"admin"

DADMIN

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting quotes around string values.

String values in SQL must be enclosed in single quotes.

3fill in blank

hard

Fix the error in the SQL query to prevent SQL injection by using a parameter placeholder.

SQL

SELECT * FROM users WHERE username = [1];

Drag options to blanks, or click blank then click option'

A?

B'user_input'

C:username

D$username

Attempts:

3 left

💡 Hint

Common Mistakes

Directly inserting user input as a string.

Using a question mark (?) is a common placeholder for parameters in prepared statements to prevent SQL injection.

4fill in blank

hard

Fill both blanks to create a query that selects usernames and emails only for active users.

SQL

SELECT [1], [2] FROM users WHERE status = 'active';

Drag options to blanks, or click blank then click option'

Ausername

Bemail

Cpassword

Did

Attempts:

3 left

💡 Hint

Common Mistakes

Selecting password or id which may expose sensitive info.

We select only the username and email columns to avoid exposing sensitive data like passwords.

5fill in blank

hard

Fill all three blanks to write a query that updates a user's password securely using a placeholder and limits update to a specific user id.

SQL

UPDATE users SET password = [1] WHERE id = [2] AND role != [3];

Drag options to blanks, or click blank then click option'

A?

B123

C'admin'

D'user'

Attempts:

3 left

💡 Hint

Common Mistakes

Hardcoding password directly, not using placeholders, or updating admin users.

Use a placeholder (?) for the new password to avoid injection, specify the user id (123), and exclude admin role from update.