Separate data from instructions

15-minute session: read for 3 minutes, trace for 3, experiment for 7, and complete the check for 2. Spend longer whenever you need.

Use parameterized queries for database values and argument arrays for process invocation. Escaping for HTML does not make a string safe for SQL or a shell. Identify the interpreter at each boundary and use the interface designed for data. This lesson does not require executing attack payloads against another service.

Practice and evidence: Predict the example or draw its state transitions. Change one assumption, test the boundary, and record the actual result. Explain what this small model does not establish about a production system.

import sqlite3
db=sqlite3.connect(":memory:")
db.execute("create table notes(value text)")
value="A student's note"
db.execute("insert into notes values (?)",(value,))
print(db.execute("select value from notes").fetchone()[0])

Expected result: A student's note

Practice and evidence

Keep three notes: your prediction, the actual result, and why they match or differ. The completion check grades understanding; the practice task builds skill.