Interview kitsBlog

Your dream job? Lets Git IT.
Interactive technical interview preparation platform designed for modern developers.

XGitHub

Platform

  • Categories

Resources

  • Blog
  • About the app
  • FAQ
  • Feedback

Legal

  • Privacy Policy
  • Terms of Service

© 2026 LetsGit.IT. All rights reserved.

LetsGit.IT/Categories/Databases
Databaseshard

What is SQL injection and how do you prevent it?

Tags
#sql-injection#security#prepared-statements
Back to categoryPractice quiz

Answer

SQL injection is when untrusted input changes the meaning of your SQL (e.g., by concatenating strings). Prevent it with parameterized queries/prepared statements, proper escaping by the driver/ORM, and least-privilege DB accounts.

Advanced answer

Deep dive

Expanding on the short answer — what usually matters in practice:

  • Context (tags): sql-injection, security, prepared-statements
  • Data model and access patterns: dominant queries (read/write ratio, sorting, pagination).
  • Indexes: when they help vs hurt (write amplification, memory).
  • Consistency & transactions: what’s guaranteed and what can bite you.
  • Explain the "why", not just the "what" (intuition + consequences).
  • Trade-offs: what you gain/lose (time, memory, complexity, risk).
  • Edge cases: empty inputs, large inputs, invalid inputs, concurrency.

Examples

A tiny example (query shape):

-- Example: index + query shape
SELECT *
FROM users
WHERE email = '[email protected]'
LIMIT 1;

Common pitfalls

  • Too generic: no concrete trade-offs or examples.
  • Mixing average-case and worst-case (e.g., complexity).
  • Ignoring constraints: memory, concurrency, network/disk costs.

Interview follow-ups

  • When would you choose an alternative and why?
  • What production issues show up and how do you diagnose them?
  • How would you test edge cases?

Related questions

Security
How should passwords be stored securely?
#passwords#hashing#security
Security
Authentication vs authorization — what’s the difference, with examples?
#authn#authz#security
Security
What is threat modeling, and how do you run a lightweight threat model for a feature?
#threat-modeling#risk
#security
DevOps
What are best practices for secure and small Docker images?
#docker#containers#security
DevOps
Configuration vs secrets — how should you manage them in DevOps?
#secrets#config#security
Cloud
IAM users vs roles: what’s the difference and how does least privilege apply?
#cloud#iam#security