codejump
EasyJavaScriptTypeScript

SQL Injection — Parameterize the Query

TypeScriptSecurityInjection

The function below builds a SQL query by concatenating user input directly into the string.

The bug: an attacker can pass admin' OR '1'='1 as the username and the resulting query becomes SELECT * FROM users WHERE username = 'admin' OR '1'='1' — always true, bypassing authentication entirely.

Your task: fix solve(username) so it returns a parameterized query — a placeholder (?) in the SQL string, with the user input passed separately as a bind parameter, never concatenated.

Sample tests

Test #1Classic OR-based injection payload
Input: ["admin' OR '1'='1"]
Output: {"query":"SELECT * FROM users WHERE username = ?","params":["admin' OR '1'='1"]}
Test #2Normal username
Input: ["alice"]
Output: {"query":"SELECT * FROM users WHERE username = ?","params":["alice"]}
Test #3Empty username
Input: [""]
Output: {"query":"SELECT * FROM users WHERE username = ?","params":[""]}
← All challenges