Detect SQL metacharacters

Challenge

Flag input that contains characters commonly abused in SQL injection — an audit aid layered on top of prepared statements.

Task

Implement int has_sql_meta(const char *s) that returns 1 if s contains a single quote ', a double quote ", a semicolon ;, or the comment marker --, and 0 otherwise.

Input

• s: a fixed NUL-terminated string the grader provides.

Output

Returns 1 if any of those metacharacters/tokens are present, 0 otherwise.

Example

has_sql_meta("a' OR '1'='1")   ->   1
has_sql_meta("admin--")        ->   1
has_sql_meta("alice")          ->   0

Edge cases

• Empty string: returns 0.

Rules

• Detection only — the real defence is parameterised queries, not filtering.

Input format

A fixed NUL-terminated string s.

Output format

1 if s contains ' " ; or --; otherwise 0.

Constraints

Detection only; the proper fix is parameterised queries.

Starter code

#include <string.h>

int has_sql_meta(const char *s) {
    /* TODO */
    return 0;
}