cybersecurity · intermediate · ~12 min · safe pentest lab

Flag SQL-injection metacharacters in input

Detect specific substrings in untrusted input. Defence-in-depth on top of parameterised queries.

Challenge

Implement:

int has_sqli_markers(const char *input);

Return 1 if input contains any of:

Otherwise return 0. input == NULL → 0 (nothing to flag).

Pure string detection. Don't sanitise, don't escape. The proper cure is prepared statements; this function is a layer.
Case-insensitive match for UNION SELECT only. Other tokens are exact.

(concept) The tokens are short and disjoint. One pass over the input checking each one is fine.
(direction) strchr for single-char tokens, strstr for the multi-char ones. For the UNION SELECT case-insensitive match, build a small lowercased copy or use a custom case-folding strstr.
(common bug) -- is a substring of any line that contains two consecutive minuses. That's fine — the function is a flagger, not a parser.

A metacharacter detector on the input layer adds defence in depth above prepared statements.

A NUL-terminated string (may be NULL).

0 or 1.

No allocation needed beyond a small stack buffer for case folding.

#include <stddef.h>

int has_sqli_markers(const char *input) {
    /* TODO */
    (void)input;
    return 0;
}

Returning a count instead of a boolean. Forgetting NULL input. Case-sensitive match for UNION SELECT.

NULL input. Empty string. Input with quotes inside legitimate text (e.g. O'Brien) — still flagged because this is a flagger, not a smart parser.

O(n) per substring check; bounded constant number of checks.

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.