Views, Procedures, and Security Coding Practice Challenges | CodeNivo

Question 1

8. Parameterized Queries in Python

Accepted Answer

with conn.cursor() as cursor:
    cursor.execute(
        "SELECT user_id, username FROM app_users WHERE username = %s",
        (username,)
    )

rows = cursor.fetchall()

for row in rows:
    print(row)

Answer

-- Practice query for SQL Injection and Parameterized Queries

Question 2

7. Parameterized Queries in Go

Accepted Answer

row := db.QueryRowContext(
    ctx,
    "SELECT user_id FROM app_users WHERE username = $1",
    username,
)

var userID int
err := row.Scan(&userID)

if err != nil {
    if errors.Is(err, sql.ErrNoRows) {
        // Handle a username that does not exist.
    } else {
        // Handle a database error.
    }
}

Answer

-- Practice query for SQL Injection and Parameterized Queries

Question 3

6. Parameterized Queries in Node.js

Accepted Answer

app.get("/users/search", async (req, res) => {
  const username = req.query.username;

if (typeof username !== "string" || username.length === 0) {
    return res.status(400).json({
      error: "A username is required"
    });
  }

try {
    const result = await pool.query(
      "SELECT user_id, username FROM app_users WHERE username = $1",
      [username]
    );

return res.json(result.rows);
  } catch (error) {
    console.error("User search failed");

return res.status(500).json({
      error: "An internal server error occurred"
    });
  }
});

Answer

-- Practice query for SQL Injection and Parameterized Queries

Views, Procedures, and Security Problems