SQL Injection and How to Prevent It
SQL injection happens when an application builds a database query by pasting user text into it. The attacker's text becomes part of the command. A login check like WHERE name = '<input>' can be turned into WHERE name = '' OR '1'='1', which is always true.
The fix is simple and complete: parameterised queries (also called prepared statements). The query text and the data travel separately, so input is always treated as a value and never as code.
The demo below uses a private in-memory database. It shows the flaw so you can recognise and remove it from your own code.
What is the correct defence against SQL injection?
Look up the user with a parameterised query (use a ? placeholder and pass the value as a tuple) and print the matching names as a list.
Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.
Tip: use the left and right arrow keys to move between lessons.