SQL injection

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What is SQL injection?

A Sending so much traffic to a website that it crashes

B Typing database commands into an input field so they run as part of a query

2. Why does a login form become open to SQL injection?

A The program joins the typed input straight into the query text

B The program keeps the user input separate from the query

3. A hacker types ' OR '1'='1 into a login form's password box. What is the aim?

A To make the password longer so it is harder to guess

B To make the query's condition always true so the login succeeds

4. Which is the correct fix for SQL injection?

A Use a parameterised query

B Hide the login form from users

5. What could an attacker do with a successful SQL injection?

A Read or delete data stored in the database

B Only change the colour of the web page

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1' OR '1'='1		AText typed into a login form that makes the query's check always true, so the attacker gets in without a password
2'; DROP TABLE users; --		Bcursor.execute("SELECT * FROM users WHERE name=?", (name,))
3Joining user input straight into a query string lets typed text become part of the SQL command		CInjected input that ends the query and adds a command to delete a table, so data is destroyed
4A parameterised query keeps input as data only, so it cannot run as a command		DThe password typed by the user is joined straight into the query, so an attacker can type SQL commands that run. Use a parameterised query instead.
5sql = "SELECT * FROM users WHERE pass='" + password + "'"		Equery = "SELECT * FROM users WHERE name='" + name + "'"
6db.run("DELETE FROM posts WHERE id=" + id)		FThe id from the user is added directly to the query, so someone could type extra commands and delete data. Use a placeholder such as id=? and pass the value separately.

Definitions

SQL injection

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Password typed: ' __ '1'='1

sql = "SELECT * FROM users WHERE n = _" cur.execute(sql, (name,))

name = input("Username: ") sql = "SELECT * FROM users WHERE n='" sql = sql _ name + "'"

Input: '; ____ TABLE users; --

username = input("Username: ") sql = "SELECT * FROM users WHERE n = ?" cur.execute(sql, (________,))

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A name = "' OR '1'='2"

B sql = "SELECT * FROM users "

C sql += "WHERE name = '" + name

D sql += "'"

Question 2

A user = input("User: ")

B sql = "SELECT * FROM users"

C sql += " WHERE name = ?"

D cur.execute(sql + user)

Question 3

A # Attacker types into the form

B user = "admin --"

C sql = "SELECT * FROM users "

D sql += "WHERE name = '" + user

Question 4

A sql = "SELECT * FROM users"

B sql += " WHERE name = " + name

C cur.execute(sql, (name,))

D print(cur.fetchall())

Question 5

A uid = input("ID: ")

B sql = "DELETE FROM notes"

C sql += " WHERE id = '?'"

D cur.execute(sql, (uid,))

Answer Key

SQL injection

Section A: Quick Questions

B — Typing database commands into an input field so they run as part of a query

A — The program joins the typed input straight into the query text

B — To make the query's condition always true so the login succeeds

A — Use a parameterised query

A — Read or delete data stored in the database

Section B: Match the Pairs

' OR '1'='1 → Text typed into a login form that makes the query's check always true, so the attacker gets in without a password

'; DROP TABLE users; -- → Injected input that ends the query and adds a command to delete a table, so data is destroyed

Joining user input straight into a query string lets typed text become part of the SQL command → query = "SELECT * FROM users WHERE name='" + name + "'"

A parameterised query keeps input as data only, so it cannot run as a command → cursor.execute("SELECT * FROM users WHERE name=?", (name,))

sql = "SELECT * FROM users WHERE pass='" + password + "'" → The password typed by the user is joined straight into the query, so an attacker can type SQL commands that run. Use a parameterised query instead.

db.run("DELETE FROM posts WHERE id=" + id) → The id from the user is added directly to the query, so someone could type extra commands and delete data. Use a placeholder such as id=? and pass the value separately.

Section C: Definitions

SQL injection — An attack where database commands are typed into an input field and run because the program joins the input straight into a query. Parameterised queries stop it.

Section D: Fill in the Blanks

Password typed: ' OR '1'='1

sql = "SELECT * FROM users WHERE n = ?"
cur.execute(sql, (name,))

name = input("Username: ")
sql = "SELECT * FROM users WHERE n='"
sql = sql + name + "'"

Input: '; DROP TABLE users; --

username = input("Username: ")
sql = "SELECT * FROM users WHERE n = ?"
cur.execute(sql, (username,))

Section E: Spot the Error

A — The attacker's input needs a condition that is always true. '1'='2' is false, so it would not expose every row. It should be '1'='1.

D — This joins the user's input straight onto the query, which is what allows SQL injection. The input should be passed separately as a parameter: cur.execute(sql, (user,)).

B — The attack needs a single quote after admin to close the string in the query. Without it, the -- comment marker stays inside the text and does nothing. It should be "admin' --".

B — Joining the input onto the query lets an attacker add their own SQL, such as ' OR '1'='1, and expose data. A parameterised query uses a ? placeholder: " WHERE name = ?".

C — Putting quotes around the placeholder turns it into the plain text '?', so the input is never used. A placeholder must stand alone: ?.