Question 1

What is SQL injection, and how do you actually prevent it?

Accepted Answer

An attack where **user input is interpreted as SQL code** rather than as data — and it happens for one reason: the query was built by concatenating strings, so the database cannot tell your instructions apart from the attacker's.

**The mechanism.** If a query is assembled as `"SELECT * FROM users WHERE email = '" + input + "'"`, an input containing a quote character ends the string early and everything after it becomes part of the command. The classic payload closes the quote and appends a condition that is always true, or terminates the statement and starts another.

**What it enables:** reading data the user should not see, modifying or deleting records, bypassing authentication entirely, and in some configurations reading files or executing commands on the host.

**The one real fix: parameterised queries (prepared statements).** The query structure is sent to the database **separately from the values**. The database parses the statement first, then binds the parameters as data — so a quote character in the input is just a quote character, and there is no path by which it becomes syntax. **This is not escaping done well; it is a different mechanism**, and that is why it works.

**What does not reliably work:**

**Manual escaping.** It depends on character set, database and context, and a single missed case is a vulnerability. Every attempt to do this by hand has a history of bypasses.

**Blocklisting keywords**, which is trivially evaded by encoding and case variation.

**Client-side validation**, which an attacker simply skips.

**Stored procedures**, which help only if they do not themselves concatenate.

**What you must handle carefully even with parameters.** Table and column names, and `ORDER BY` clauses, **cannot be parameterised** — they are identifiers, not values. Where these must be dynamic, validate against an **allowlist** of known-good names rather than interpolating input.

**Defence in depth:** least-privilege database accounts, so a successful injection reaches as little as possible; input validation as a secondary control; disabling detailed error messages in production; and a web application firewall as a mitigation, never as the fix.

**ORMs help by default** and reintroduce the risk the moment you drop to raw SQL.

Question 2

What are common security vulnerabilities in Django applications and how can I prevent them?

Accepted Answer

Django security vulnerabilities include XSS, SQL Injection, CSRF, and insecure direct object references. Prevent these by using Django's built-in protections and best practices.

Question 3

What is cross-site scripting (XSS)?

Accepted Answer

An attack where attacker-controlled content is executed as JavaScript in another user's browser, in the context of your site — which means it runs with that user's session, cookies and permissions.

Question 4

What is dependency injection and why does it help?

Accepted Answer

Dependency injection means a component receives the things it depends on from outside, rather than constructing them itself. The contrast. Without it, a class creates its own collaborators: A

Question 5

What are the best practices for REST API security?

Accepted Answer

Implementing best practices for REST API security, such as authentication, HTTPS, and input validation, is crucial for protecting sensitive data and preventing unauthorized access.

Question 6

When should I use a database transaction?

Accepted Answer

The rule is simple to state: use a transaction whenever two or more writes must either all succeed or all fail. If a partial result would leave your data in a state that should never exist, those

Question 7

What is the difference between a unit test and an integration test?

Accepted Answer

A unit test exercises one piece of logic in isolation, replacing its collaborators with stand-ins. An integration test exercises several real components together, typically including something

Related Questions