backendgym backendgym · reps Sign in with GitHubSign in
← SQL · Scaling and security 3 of 6

03Judge a login check

sql-scaling-and-security / reps/03/README.md

reps/03/app.py is a short psycopg login check. Read it first, then run it with your database in DATABASE_URL, DATABASE_URL=<connection> python reps/03/app.py, and compare with the expected result below. Fix it so the hostile password logs nobody in, and run it again.

Expected once fixed: 0 rows for the password ' OR 1=1 --. The shipped file returns all 4 users.

After the rep
  1. 1 Write out the WHERE clause the shipped script actually sent. Which part of the hostile password made it true for every row, and why would stripping quotes from the input not be enough?