← Years 9–10 Digital Systems

SQL injection

An attack where database commands are typed into an input field and run because the program joins the input straight into a query. Parameterised queries stop it.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 41, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 46

Understanding SQL injection in Years 9–10 Digital Systems

What it does: The input is joined directly into the query, which is what makes SQL injection possible. The ? placeholder sends the input separately from the SQL, so injected commands are treated as plain text. This is the fix. SQL injection tricks a program into running commands that were typed into a form. Flooding a site with traffic is a denial of service attack. '1'='1' is always true, so the check can pass without the real password. A parameterised query sends the input as data only, so it is never run as a command. Hiding the form doesn't fix the flaw. SQL injection can expose private records such as names and passwords, or delete whole tables.

Common mistakes: The attacker's input needs a condition that is always true. '1'='2' is false, so it would not expose every row. It should be '1'='1. This joins the user's input straight onto the query, which is what allows SQL injection. The input should be passed separately as a parameter: cur.execute(sql, (user,)).

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add SQL injection to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

What is SQL injection?

Sending so much traffic to a website that it crashesTyping database commands into an input field so they run as part of a query

Matches

sql = "SELECT * FROM users WHERE pass='" + password + "'"

↓

The password typed by the user is joined straight into the query, so an attacker can type SQL commands that run. Use a parameterised query instead.

Applying

Meanings

Term

SQL injection

Meaning

An attack where database commands are typed into an input field and run because the program joins the input straight into a query. Parameterised queries stop it.

Practice

-- Attacker types: ' OR '1'='1

Testing

Gaps

Password typed: ' '1'='1

Check Answer

Spots

1name = "' OR '1'='2"

2sql = "SELECT * FROM users "

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What is SQL injection?

A. Sending so much traffic to a website that it crashes

B. Typing database commands into an input field so they run as part of a query ✓

SQL injection tricks a program into running commands that were typed into a form. Flooding a site with traffic is a denial of service attack.

2. Why does a login form become open to SQL injection?

A. The program joins the typed input straight into the query text ✓

B. The program keeps the user input separate from the query

If input is joined directly into the query, the database can't tell the student's data from real commands.

3. A hacker types ' OR '1'='1 into a login form's password box. What is the aim?

A. To make the password longer so it is harder to guess

B. To make the query's condition always true so the login succeeds ✓

'1'='1' is always true, so the check can pass without the real password.

4. Which is the correct fix for SQL injection?

A. Use a parameterised query ✓

B. Hide the login form from users

A parameterised query sends the input as data only, so it is never run as a command. Hiding the form doesn't fix the flaw.

5. What could an attacker do with a successful SQL injection?

A. Read or delete data stored in the database ✓

B. Only change the colour of the web page

SQL injection can expose private records such as names and passwords, or delete whole tables.

Match the Pairs

' OR '1'='1 → Text typed into a login form that makes the query's check always true, so the attacker gets in without a password

'; DROP TABLE users; -- → Injected input that ends the query and adds a command to delete a table, so data is destroyed

Joining user input straight into a query string lets typed text become part of the SQL command → query = "SELECT * FROM users WHERE name='" + name + "'"

A parameterised query keeps input as data only, so it cannot run as a command → cursor.execute("SELECT * FROM users WHERE name=?", (name,))

sql = "SELECT * FROM users WHERE pass='" + password + "'" → The password typed by the user is joined straight into the query, so an attacker can type SQL commands that run. Use a parameterised query instead.

db.run("DELETE FROM posts WHERE id=" + id) → The id from the user is added directly to the query, so someone could type extra commands and delete data. Use a placeholder such as id=? and pass the value separately.

Key Term

SQL injection

An attack where database commands are typed into an input field and run because the program joins the input straight into a query. Parameterised queries stop it.

Fill in the Blanks

1. Password typed: ' OR '1'='1

Hint: Type the SQL keyword that makes the login condition always true

2. sql = "SELECT * FROM users WHERE n = ?" cur.execute(sql, (name,))

Hint: Type the placeholder symbol that keeps the input separate from the query

3. name = input("Username: ") sql = "SELECT * FROM users WHERE n='" sql = sql + name + "'"

Hint: Type the operator that joins the user's input straight into the query text

4. Input: '; DROP TABLE users; --

Hint: Type the SQL command that deletes an entire table of data

5. username = input("Username: ") sql = "SELECT * FROM users WHERE n = ?" cur.execute(sql, (username,))

Hint: Type the variable holding the user's input that is passed in separately from the query

Spot the Error

Question 1

A name = "' OR '1'='2"

B sql = "SELECT * FROM users "

C sql += "WHERE name = '" + name

D sql += "'"

Line A — The attacker's input needs a condition that is always true. '1'='2' is false, so it would not expose every row. It should be '1'='1.

Question 2

A user = input("User: ")

B sql = "SELECT * FROM users"

C sql += " WHERE name = ?"

D cur.execute(sql + user)

Line D — This joins the user's input straight onto the query, which is what allows SQL injection. The input should be passed separately as a parameter: cur.execute(sql, (user,)).

Question 3

A # Attacker types into the form

B user = "admin --"

C sql = "SELECT * FROM users "

D sql += "WHERE name = '" + user

Line B — The attack needs a single quote after admin to close the string in the query. Without it, the -- comment marker stays inside the text and does nothing. It should be "admin' --".

Question 4

A sql = "SELECT * FROM users"

B sql += " WHERE name = " + name

C cur.execute(sql, (name,))

D print(cur.fetchall())

Line B — Joining the input onto the query lets an attacker add their own SQL, such as ' OR '1'='1, and expose data. A parameterised query uses a ? placeholder: " WHERE name = ?".

Question 5

A uid = input("ID: ")

B sql = "DELETE FROM notes"

C sql += " WHERE id = '?'"

D cur.execute(sql, (uid,))

Line C — Putting quotes around the placeholder turns it into the plain text '?', so the input is never used. A placeholder must stand alone: ?.

Student with a class code? Join your class →