Loading...
Loading...
A classic SQL injection vulnerability in a login function that allows attackers to bypass authentication.
1def login(username, password):2 # Connect to database3 conn = sqlite3.connect('users.db')4 cursor = conn.cursor()56 query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"7 cursor.execute(query)89 user = cursor.fetchone()10 conn.close()1112 if user:13 return {"success": True, "user": user}14 return {"success": False, "error": "Invalid credentials"}
This code is vulnerable to SQL injection because user input is directly concatenated into the SQL query. An attacker can input `' OR '1'='1` as the username to bypass authentication entirely.
Attacker inputs a malicious username to bypass password check
Username: ' OR '1'='1' --
Password: anythingQuery becomes:
SELECT * FROM users WHERE username = '' OR '1'='1' --' AND password = 'anything'
✓ The OR '1'='1' always evaluates to true
✓ The -- comments out the rest of the query
✓ Returns first user in database (usually admin)