HackBlue

Labs / Web and API security

Parameterized vs concatenated queries

Build the same product search three ways and watch the token view: concatenation lets input change the query, bound parameters and allowlists keep it a value.

  • Interactive lab
  • Beginner
  • 5 steps
  • 0 of 5 solved

Goal

The product search on a shop sends three user inputs to the database: the search text, the sort column, and the page size. Today all three are glued into the SQL string.

For each input, choose how the server builds the query, type any value you like, and watch the token view. The query is safe when no input can change its shape. Nothing here runs against a real database.

Search box qString concatenation
SELECT id, name, price FROM products WHERE name LIKE '%O'Brien%'

Unterminated string starting at character 64

Sort column sortString concatenation
ORDER BY price
  1. ORDERkeyword
  2. BYkeyword
  3. priceidentifier

The input stayed a single value. The query shape matches the template.

Page size limitString concatenation
LIMIT 25
  1. LIMITkeyword
  2. 25number

The input stayed a single value. The query shape matches the template.

At least one input can still change the query or silently break it.

Steps

  1. 01Pick a construction method for all three inputs so that no value, typed or not, can change the shape of the query.

    Do this in the workbench above. This step completes itself when the condition is met.

  2. 02With string concatenation on the search box, which everyday input makes the query fail with a syntax error?

  3. 03Why is escaping quotes not a complete fix?

  4. 04What happens if the sort column is sent as a bound parameter?

  5. 05What does a bound parameter guarantee?