SQL injection testing in Testing Fundamentals - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding SQL Injection Risks

Which of the following best describes why SQL injection is a serious security risk?

A It allows attackers to modify database queries to access or manipulate data without authorization.

B It causes the database server to crash due to syntax errors in queries.

C It encrypts the database making data unreadable to users.

D It automatically updates the database schema without developer consent.

💡 Hint

Think about what happens when user input is not handled safely in database queries.

SQL injection lets attackers change the intended database commands, which can lead to unauthorized data access or changes.

❓ Predict Output

intermediate

Detecting SQL Injection Vulnerability Output

What will be the output of the following Python code simulating a vulnerable SQL query if the user input is "' OR '1'='1"?

Testing Fundamentals

user_input = "' OR '1'='1"
query = f"SELECT * FROM users WHERE username = '{user_input}'"
print(query)

A SELECT * FROM users WHERE username = '' OR 1=1

B SELECT * FROM users WHERE username = '' OR '1'='1'

C SELECT * FROM users WHERE username = 'user_input'

D SyntaxError due to unmatched quotes

💡 Hint

Look carefully at how the input is inserted into the query string.

The input is inserted directly, so the query becomes: SELECT * FROM users WHERE username = '' OR '1'='1', which always returns true.

❓ assertion

advanced

Choosing the Correct Assertion for SQL Injection Test

You run an automated test that sends a malicious input to a login form. Which assertion best verifies the application is protected against SQL injection?

A Assert that the response redirects to the admin dashboard.

B Assert that the response status code is 500 Internal Server Error.

C Assert that the response contains raw SQL code.

D Assert that the response contains an error message about invalid credentials.

💡 Hint

Think about what a safe application should do when given bad input.

A safe app rejects the login with an invalid credentials message. A server error or SQL code exposure means vulnerability.

🔧 Debug

advanced

Debugging a Failing SQL Injection Test

Given this test code snippet, why does the SQL injection test fail to detect vulnerability?

def test_sql_injection(client):
    payload = "' OR '1'='1"
    response = client.post('/login', data={'username': payload, 'password': 'any'})
    assert b"Welcome" not in response.data

A The test fails because the assertion expects no welcome message, but the app always shows it regardless of login success.

B The payload is not properly escaped, causing a syntax error in the test code.

C The test uses POST instead of GET, which is not supported by the login endpoint.

D The assertion is reversed; it should check that the welcome message is present.

💡 Hint

Consider what the app actually returns on failed login attempts.

If the app always shows "Welcome" regardless of login success, the test assertion will fail to detect injection.

❓ framework

expert

Designing a SQL Injection Test Framework Feature

Which feature is most effective to include in an automated testing framework to detect SQL injection vulnerabilities?

A Runs unit tests on backend functions without any user input simulation.

B Only tests for cross-site scripting (XSS) vulnerabilities in the frontend code.

C Automatically injects common SQL injection payloads into all input fields and checks for database errors or unexpected data exposure.

D Validates HTML syntax of all web pages to ensure accessibility compliance.

💡 Hint

Think about what helps find SQL injection issues automatically.

Injecting known SQL attack strings and checking for errors or data leaks helps find injection flaws effectively.

Practice

1. What is the main goal of SQL injection testing in software testing?

easy

A. To check if user input can change database queries and cause harm

B. To improve the speed of SQL queries

C. To test the user interface design

D. To verify the database schema structure

Solution

1. Step 1: Understand SQL injection testing purpose

   SQL injection testing checks if user inputs can alter SQL queries in harmful ways.

2. Step 2: Compare options with testing goal

   Only To check if user input can change database queries and cause harm matches the goal of detecting harmful input effects on queries.

3. Final Answer:

   To check if user input can change database queries and cause harm -> Option A

4. Quick Check:

   SQL injection testing = check harmful input [OK]

Hint: Focus on input impact on queries, not UI or speed [OK]

Common Mistakes:

• Confusing SQL injection testing with performance testing
• Thinking it tests UI or database design
• Ignoring the role of user input in testing

2. Which of the following is a correct example of an input used in SQL injection testing?

easy

A. DROP TABLE users;

B. SELECT * FROM users

C. INSERT INTO users VALUES ('admin')

D. ' OR '1'='1

Solution

1. Step 1: Identify typical SQL injection input

   Inputs like ' OR '1'='1 try to change query logic to always true.

2. Step 2: Check other options

   Options A, B, and D are full SQL commands, not typical injection inputs entered by users.

3. Final Answer:

   ' OR '1'='1 -> Option D

4. Quick Check:

   Injection input = ' OR '1'='1 [OK]

Hint: Look for input that changes query logic with OR and quotes [OK]

Common Mistakes:

• Choosing full SQL commands as injection input
• Not recognizing the use of quotes and OR in injection
• Confusing injection input with SQL statements

3. Consider this SQL query in a login system:

SELECT * FROM users WHERE username = '{input}' AND password = '{input}';

If the input for username is admin and for password is ' OR '1'='1, what will happen?

medium

A. The query will return no results

B. The query will cause a syntax error

C. The query will return all users, bypassing password check

D. The query will only return the admin user

Solution

1. Step 1: Substitute inputs into query

   The query becomes: SELECT * FROM users WHERE username = 'admin' AND password = '' OR '1'='1';

2. Step 2: Analyze the WHERE clause logic

   The OR '1'='1' makes the password condition always true, so the query returns all users matching username or always true condition.

3. Final Answer:

   The query will return all users, bypassing password check -> Option C

4. Quick Check:

   Injection bypasses password = returns all users [OK]

Hint: OR '1'='1' makes condition always true, bypassing checks [OK]

Common Mistakes:

• Ignoring OR logic and thinking password check still applies
• Assuming syntax error without checking quotes
• Thinking only admin user is returned

4. You have this vulnerable SQL query:

query = "SELECT * FROM products WHERE id = '" + user_input + "'";

Which fix will prevent SQL injection?

medium

A. Add more single quotes around user_input

B. Use parameterized queries or prepared statements

C. Remove the WHERE clause

D. Convert user_input to uppercase

Solution

1. Step 1: Identify the vulnerability

   Concatenating user input directly into query allows injection.

2. Step 2: Choose the correct fix

   Using parameterized queries safely separates input from code, preventing injection.

3. Final Answer:

   Use parameterized queries or prepared statements -> Option B

4. Quick Check:

   Parameterized queries prevent injection [OK]

Hint: Never concatenate input; use parameters instead [OK]

Common Mistakes:

• Thinking adding quotes fixes injection
• Removing WHERE clause breaks functionality
• Changing case does not prevent injection

5. A web app uses this query to search users:

SELECT * FROM users WHERE name LIKE '%{input}%';

Which input is the safest to test for SQL injection without causing errors or data loss?

hard

A. normaluser

B. admin'; DROP TABLE users;--

C. '; EXEC xp_cmdshell('dir');--

D. ' OR '1'='1

Solution

1. Step 1: Understand safe testing input

   Safe input should not break query syntax or cause harmful commands.

2. Step 2: Evaluate options

   Options A, B, and C contain injection attempts or dangerous commands; only D is a normal string safe for testing.

3. Final Answer:

   normaluser -> Option A

4. Quick Check:

   Safe test input = normaluser [OK]

Hint: Use normal strings to test safely before injection attempts [OK]

Common Mistakes:

• Using dangerous inputs that cause errors or data loss
• Assuming all injection inputs are safe to test
• Not understanding query context with LIKE and wildcards