SecureMidSecurityAuto-graded

Fix a login where user input becomes SQL

Tests whether a flaw that turns typed input into database commands is fixed at the root, with logins still working.auth.py is the data-access layer behind a login form and a user-directory search box, and both build their SQL by gluing caller input directly into the query string. Against the real database underneath, that is textbook injection: a crafted username comments out the password check and logs in as another user, and a crafted search term returns every row in the table. Fix both so injection fails and legitimate use keeps working.

25 min

python, sqlite

Start lab

You're done when

Login succeeds for correct credentials and fails for incorrect ones.
Search returns the right results for ordinary queries.
The authentication bypass no longer works — crafted input cannot log in without the password.
Crafted search input can no longer dump rows it should not return.

What it measures

Database security and access controlClosing injection at the query construction layer rather than trying to sanitise hostile input.

SQLRewriting queries to bind parameters correctly while preserving their behaviour.

Verified remediationConfirming both that the attacks now fail and that ordinary use is unaffected — either half alone is not a fix.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

25 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo