SGSPECTER.GHOSTCOMMUNITY EDITION
← LABS
// GUIDED TRAINING · Secure Coding

Query Trail

SQL parameterization

Medium350 PTSOFFLINE SIMULATION
// 01 · LEARN

SQL PARAMETERIZATION

Building SQL by concatenating untrusted strings changes the query structure. Parameterized statements keep values separate from SQL syntax.

LEARNING GOAL

Identify the failure from the supplied synthetic evidence and explain a defensive fix.

// 02 · INVESTIGATE

EVIDENCE

UNSAFE: sql = "SELECT * FROM items WHERE sku='" + sku + "'"
SAFE: sql = "SELECT * FROM items WHERE sku=?"; db.execute(sql,[sku])
review_marker=parameters_not_patches
HINT

The safe version binds the sku as a value.

// 03 · PRACTICE

KNOWLEDGE CHECK

Which query construction should replace concatenation?

// 04 · CAPTURE FLAG

Submit the review marker in SG{marker} format.

Progress stays in this browser.