cybersecurity · beginner · ~15 min · safe pentest lab

Does the query use a placeholder?

Recognise parameterized queries.

Challenge

Recognise a parameterised SQL query by the presence of a ? placeholder — the marker that the driver will bind values separately instead of interpolating them as text.

Task

Implement int uses_placeholder(const char *query) that returns 1 if query contains a ? placeholder, and 0 otherwise.

Input

  • query: a NUL-terminated SQL query string the grader provides.

Output

Returns 1 if a ? appears in the query, 0 otherwise.

Example

uses_placeholder("SELECT * FROM u WHERE id = ?")   ->   1
uses_placeholder("SELECT * FROM u WHERE id = 5")   ->   0

Edge cases

  • A query with no ? returns 0.

Input format

A NUL-terminated SQL query string.

Output format

1 if the query contains a '?' placeholder; otherwise 0.

Constraints

Look for a '?' character.

Starter code

#include <string.h>

int uses_placeholder(const char *query) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.