cybersecurity · intermediate · ~15 min
Recognise common signs of SQL injection attempts in user-supplied data — as a logging/alerting heuristic, not a sanitiser.
Scan a string for characters and sequences commonly seen in SQL-injection attempts — as a logging heuristic, not a defence.
Implement int contains_sql_special(const char *s) that returns 1 if s contains any of: a single quote, a double quote, a semicolon, the two-character sequence --, or the two-character sequence that starts a SQL block comment (/*). Otherwise return 0. No main — the grader calls it.
s: a NUL-terminated string to inspect.
1 if any risky character or sequence is present, 0 if the string is clean.
contains_sql_special("hello world") -> 0
contains_sql_special("O'Brien") -> 1 (single quote)
contains_sql_special("a;b") -> 1 (semicolon)
contains_sql_special("a--b") -> 1 (-- sequence)
0.Detecting SQL-special characters in user input is a (toy, defensive) first step toward understanding SQL injection. In real code you'd use parameterised queries, not blacklists — but the detection skill matters for audits.
A NUL-terminated string s to inspect.
1 if a risky character or sequence is present, else 0.
Detection heuristic only; the real defence is parameterised queries.
int contains_sql_special(const char *s) {
/* TODO */
return 0;
}
Treating ' (single quote) but missing -- (comment), ; (statement separator), or \ (escape). Black-listing alone is unsafe in production — always parameterise.
Empty input. Unicode escape sequences. Comment style --.
O(strlen).
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.