← ACARA Digital Technologies Years 9–10

SQL injection

An attack where SQL commands typed into an input box run because the program joins the input straight into a query. Parameterised queries stop it by treating input only as data.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 57, QCE Digital Solutions Unit 2 — Prototype Data Solutions — Module 81, WA Computer Science ATAR Year 11 — Cyber Security — Module 51

Understanding SQL injection in ACARA Digital Technologies Years 9–10

What it does: Joining the name straight into the query lets the user's text change the SQL command. This is the weakness that SQL injection exploits. The command has a placeholder and the input is passed on its own. The database never runs the input as SQL. '1'='1' is always true, so the query can match every row and let the attacker log in without a real password. Code injection happens when input meant to be data gets run as commands. SQL injection is code injection aimed at a database. A smaller box does not stop commands. Parameterised queries stop the input from being treated as SQL.

Common mistakes: eval() runs whatever the user types as Python code, which is code injection. input() already gives plain text that the parameterised query can treat as data. It should be name = input("Name: "). Putting quotes around the ? turns it into the literal text '?', so no value is bound. The placeholder must stand alone: WHERE owner = ?

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add SQL injection to a class →

This module's key terms are also in a printable crossword (Modules 782–809) and word search (Modules 743–809).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A login form builds its query by joining the typed username straight into the SQL text. Which attack does this allow?

SQL injectionDenial of service

Matches

query = "DELETE FROM notes WHERE id = " + user_input

↓

The user input is joined straight into the SQL string, so an attacker could type extra commands like 1 OR 1=1 and delete every note. Use a parameterised query instead.

Applying

Meanings

Term

SQL injection

Meaning

An attack where SQL commands typed into an input box run because the program joins the input straight into a query. Parameterised queries stop it by treating input only as data.

Practice

SELECT firstName, lastName FROM students WHERE lastName = 'Smith' OR '1'='1';

Testing

Gaps

q = "SELECT * FROM users WHERE id=" uid

Check Answer

Spots

1name = eval(input("Name: "))

2q = "SELECT * FROM users"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A login form builds its query by joining the typed username straight into the SQL text. Which attack does this allow?

A. Denial of service

B. SQL injection ✓

Joining input straight into a query lets an attacker type SQL commands that the database runs. That is SQL injection.

2. What does a parameterised query do with user input?

A. Treats it only as data, never as SQL commands ✓

B. Runs it as part of the SQL command

Parameterised queries keep the command and the input separate, so typed text can never change the query.

3. Which line is open to SQL injection?

A. query = "SELECT * FROM users WHERE name = '" + name + "'" ✓

B. query = "SELECT * FROM users WHERE name = ?"

The first line joins the input into the query text. The second uses a ? placeholder, which is a parameter.

4. An attacker types ' OR '1'='1 into a password box. What is the attacker trying to do?

A. Make the website load faster

B. Make the WHERE condition always true ✓

'1'='1' is always true, so the query can match every row and let the attacker log in without a real password.

5. SQL injection is an example of which idea?

A. Code injection: input is run as code ✓

B. Interception: data is read on a network

Code injection happens when input meant to be data gets run as commands. SQL injection is code injection aimed at a database.

Match the Pairs

' OR '1'='1 → Injected text that makes a login check always true, so the attacker gets in without a password

cursor.execute("SELECT * FROM users WHERE name = ?", (name,)) → A parameterised query that treats the input only as data, so injected SQL cannot run

Code injection happens when a program joins user input straight into a query string, so typed text becomes part of the command → query = "SELECT * FROM users WHERE name = '" + name + "'"

A parameterised query stops SQL injection by sending the command and the input separately → cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

query = "DELETE FROM notes WHERE id = " + user_input → The user input is joined straight into the SQL string, so an attacker could type extra commands like 1 OR 1=1 and delete every note. Use a parameterised query instead.

cursor.execute("SELECT * FROM users WHERE name = '" + name + "'") → Even though execute is used, the name is still joined into the query text, so it is not parameterised and injected SQL can still run.

Key Term

SQL injection

An attack where SQL commands typed into an input box run because the program joins the input straight into a query. Parameterised queries stop it by treating input only as data.

Fill in the Blanks

1. q = "SELECT * FROM users WHERE id=" + uid

Hint: Type the operator that joins the raw user input straight onto the query text.

2. name = "x' OR '1'='1"

Hint: Type the SQL keyword that makes the whole condition always true when an attacker types it into the input box.

3. sql = "SELECT * FROM users WHERE id=?" cur.execute(sql, (uid,))

Hint: Type the placeholder symbol that marks where a parameter value will go in a parameterised query.

4. sql = "SELECT * FROM users WHERE id=?" cur.execute(sql, (uid,))

Hint: Type the method name that runs the query while passing the input separately as data.

5. sql = "SELECT * FROM users WHERE id=?" cur.execute(sql, (uid,))

Hint: Type the variable holding the user's input that is passed as a parameter, so it is treated only as data.

Spot the Error

Question 1

A name = eval(input("Name: "))

B q = "SELECT * FROM users"

C q += " WHERE name = ?"

D cur.execute(q, (name,))

Line A — eval() runs whatever the user types as Python code, which is code injection. input() already gives plain text that the parameterised query can treat as data. It should be name = input("Name: ").

Question 2

A q = "SELECT * FROM pets"

B q += " WHERE owner = '?'"

C owner = input("Owner: ")

D cur.execute(q, (owner,))

Line B — Putting quotes around the ? turns it into the literal text '?', so no value is bound. The placeholder must stand alone: WHERE owner = ?

Question 3

A name = input("Name: ")

B q = "SELECT * FROM users"

C q += " WHERE name = " + name

D cur.execute(q, (name,))

E print(cur.fetchall())

Line C — Joining the input straight into the query text lets an attacker type SQL such as x' OR '1'='1 and have it run. Use the ? placeholder and pass name separately: q += " WHERE name = ?"

Question 4

A q = "SELECT * FROM accounts"

B q += " WHERE email = "

C email = input("Email: ")

D cur.execute(q, (email,))

Line B — The placeholder is missing, so there is nowhere for the input to go as data. A parameterised query needs a ? placeholder: WHERE email = ?

Question 5

A uid = input("ID: ")

B q = "SELECT * FROM users"

C q += f" WHERE id = {uid}"

D cur.execute(q, (uid,))

Line C — An f-string pastes the typed text straight into the SQL, so injected commands would run. Use a ? placeholder instead: q += " WHERE id = ?"

Student with a class code? Join your class →