codejump
MediumPython

Parameterize SQL Query

PythonSecurityDatabases

The function below builds a SQL query by embedding user input directly into the string.

The bug: an attacker can pass "1' OR '1'='1" as user_id and dump the entire users table (or worse, DROP TABLE users).

Your task: fix solve(user_id) so it returns a parameterized query dict instead of a raw string:

# Expected return shape
{'sql': 'SELECT * FROM users WHERE id = %s', 'params': [user_id]}

The sql string must use the %s placeholder (the standard Python DB-API convention). The user input must only ever appear in params — never embedded in the SQL string.

Sample tests

Test #1Basic numeric id
Input: ["42"]
Output: {"sql":"SELECT * FROM users WHERE id = %s","params":["42"]}
Test #2SQL injection attempt stays in params
Input: ["1' OR '1'='1"]
Output: {"sql":"SELECT * FROM users WHERE id = %s","params":["1' OR '1'='1"]}
Test #3String id with hyphen
Input: ["user-123"]
Output: {"sql":"SELECT * FROM users WHERE id = %s","params":["user-123"]}
← All challenges