Code ReviewIntermediate~15 min

Review: SQL Injection Vulnerability

pythonsecuritysql-injectiondatabase

Code Review Task

Please review the following Python code.

Background

This code is part of a user management system that searches for and authenticates user information. It uses a SQLite database.

Review Aspects

Security issues
Possibility of SQL injection
Input validation
Password handling security

Your Answer

user_service.pypython

import sqlite3
 
def find_user(username):
    """Find user by username"""
    conn = sqlite3.connect('users.db')
    query = f"SELECT * FROM users WHERE username = '{username}'"
    cursor = conn.cursor()
    cursor.execute(query)
    return cursor.fetchone()
 
def authenticate(username, password):
    """Authenticate user"""
    conn = sqlite3.connect('users.db')
    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
    cursor = conn.cursor()
    cursor.execute(query)
    result = cursor.fetchone()
    return result is not None

行番号をクリックしてコメントを追加（Shift+クリックで範囲選択）

Review Summary

Minimum 100 characters required

Approval Decision

Overall Severity

Add comments and enter at least 100 characters in the summary

Model Answer

Submit your answer or click "Show" to view the model answer.