7 lines
1.4 KiB
HTML
7 lines
1.4 KiB
HTML
<!doctype html><html lang="en"><meta charset="utf-8"><title>Separate data from instructions</title><h1>Separate data from instructions</h1><p>15-minute session: read for 3 minutes, trace for 3, experiment for 7, and complete the check for 2. Spend longer whenever you need.</p><p>Use parameterized queries for database values and argument arrays for process invocation. Escaping for HTML does not make a string safe for SQL or a shell. Identify the interpreter at each boundary and use the interface designed for data. This lesson does not require executing attack payloads against another service.</p><p><strong>Practice and evidence:</strong> Predict the example or draw its state transitions. Change one assumption, test the boundary, and record the actual result. Explain what this small model does not establish about a production system.</p><pre><code class="language-python">import sqlite3
|
|
db=sqlite3.connect(":memory:")
|
|
db.execute("create table notes(value text)")
|
|
value="A student's note"
|
|
db.execute("insert into notes values (?)",(value,))
|
|
print(db.execute("select value from notes").fetchone()[0])
|
|
</code></pre><p><strong>Expected result:</strong> <code>A student's note</code></p><h3>Practice and evidence</h3><p>Keep three notes: your prediction, the actual result, and why they match or differ. The completion check grades understanding; the practice task builds skill.</p></html> |