Login SQL injection
Review this Python Flask login handler.
What a strong answer looks like
Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.
0:00 of about 20 min
Mark a line and say what kind of problem it is.0 findings
1import sqlite3
2from flask import request, session
3
4def login():
5 username = request.form['username']
6 password = request.form['password']
7 conn = sqlite3.connect('app.db')
8 cur = conn.cursor()
9 query = "SELECT id, role FROM users WHERE username = '%s' AND password = '%s'" % (username, password)
10 cur.execute(query)
11 row = cur.fetchone()
12 if row:
13 session['uid'] = row[0]
14 session['role'] = row[1]
15 return {'ok': True}
16 return {'ok': False}, 401
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.