SQL injection testing in Testing Fundamentals - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely query a user by ID using parameterized queries.

Testing Fundamentals

cursor.execute("SELECT * FROM users WHERE id = [1]", (user_id,))

Drag options to blanks, or click blank then click option'

Aid

B?

Cuser_id

D%s

Attempts:

3 left

💡 Hint

Common Mistakes

Using string concatenation instead of placeholders

Using incorrect placeholder syntax

Using %s as a placeholder in parameterized queries prevents SQL injection by separating code from data.

2fill in blank

medium

Complete the code to test if the input is vulnerable to SQL injection by adding a common attack string.

Testing Fundamentals

test_input = "admin' OR 1=1 --" + [1]

Drag options to blanks, or click blank then click option'

A""

B"; DROP TABLE users;"

C"; --"

D"'"

Attempts:

3 left

💡 Hint

Common Mistakes

Adding extra characters after the comment sequence

Using semicolons that may cause syntax errors

The common injection string ends with -- to comment out the rest of the query, so no extra characters are needed after it.

3fill in blank

hard

Fix the error in the code that tries to detect SQL injection by checking for dangerous keywords.

Testing Fundamentals

if any(keyword in user_input.lower() for keyword in [1]):
    print("Potential SQL injection detected")

Drag options to blanks, or click blank then click option'

A["select", "drop", "insert"]

B['select drop insert']

Cselect, drop, insert

D"select, drop, insert"

Attempts:

3 left

💡 Hint

Common Mistakes

Passing a single string instead of a list

Using incorrect list syntax

The code expects a list of keywords to check individually. A list of strings is correct.

4fill in blank

hard

Fill both blanks to create a safe SQL query using parameterized inputs and prevent injection.

Testing Fundamentals

query = "SELECT * FROM users WHERE username = [1]"
cursor.execute(query, ([2],))

Drag options to blanks, or click blank then click option'

A%s

Busername

Cuser_input

D"user_input"

Attempts:

3 left

💡 Hint

Common Mistakes

Using string concatenation instead of placeholders

Passing the variable name as a string instead of the variable itself

The query uses %s as a placeholder, and the actual user input variable is passed as a tuple to execute.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that filters out inputs containing SQL injection risk keywords.

Testing Fundamentals

safe_inputs = {input_str: len(input_str) for input_str in inputs if not any([1] in input_str.lower() for [2] in [3])}

Drag options to blanks, or click blank then click option'

Akeyword

C["drop", "select", "insert", "delete"]

D"select"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a string instead of a variable in the loop

Not using a list of keywords

Checking for only one keyword

The comprehension checks if any keyword from the list is in the input string (case-insensitive). It uses a variable keyword to iterate over the list of keywords.