exploit_code
import sqlite3
conn = sqlite3.connect(':memory:')
conn.execute('CREATE TABLE users(name TEXT)')
conn.executemany('INSERT INTO users VALUES (?)', [('alice',), ('bob',)])
result = get_user(conn, "' OR '1'='1")
patched_code
import sqlite3
def get_user(conn, name):
return conn.execute("SELECT * FROM users WHERE name = ?", (name,)).fetchall()
vulnerable_code
import sqlite3
def get_user(conn, name):
query = f"SELECT * FROM users WHERE name = '{name}'"
return conn.execute(query).fetchall()
expected_pre_patch_resultreturns ALL rows in the users table (2 rows), bypassing the intended single-user filter
expected_post_patch_resultreturns zero rows (no user literally named "' OR '1'='1"), exploit neutralized