CS Kairos Learn
CS KAIROS · LEARNING LIBRARY

M15 · SQL Injection · Safe practice

This module uses offline data, self-created inputs or tabletop scenarios. Follow the steps and check the evidence you produce.

Offline exercise: query an in-memory database

Use local Python 3 with its sqlite3 module. No disk database, networking or real personal data is used.

  1. Read the program and locate fixed SQL and bound values.
  2. Run it locally and check the output.
  3. Change the lookup value to an absent name and expect an empty list.
import sqlite3
con = sqlite3.connect(":memory:")
try:
    con.execute("CREATE TABLE people (name TEXT)")
    con.execute("INSERT INTO people VALUES (?)", ("O'Neil",))
    print(con.execute("SELECT name FROM people WHERE name = ?", ("O'Neil",)).fetchall())
finally:
    con.close()

Expected result

The first output is [("O'Neil",)]; an absent name produces [].

Check your work

Why is substituting a table name a different problem from binding a value?

Finish and clean up

The in-memory database closes when the program ends and leaves no data file.