Students building websites in a high-school computer science major (using HTML, javascript, jsp and MySQL) don't seem to understand the dangers of SQL injections. I try to explain that unchecked SQL statements can really ruin their databases, but just telling them doesn't get the message through. The students build small websites as a project, and they work on that project for one semester (they do this during the 2nd semester. In the first one they are taught HTML, css, javascript, jsp and MySQL. Rather efficient, isn't it?). The project guidelines specify they need login and registration pages, and a users database (among other requirements). After teaching how a login\sign up page might work I explain a bit about SQL injection. However, the students simply don't see the dangers SQL injection poses. I explain that I can cause the entire users table to be deleted just by signing in, but just saying it apparently isn't enough.So, how can I demonstrate the dangers of SQL injection? Note: This isn't a self-learning question (details can be found in the comments).
Demonstrating the possible dangers of SQL injection
lesson ideas;high school;sql injection
The best way to show your students that their work is vulnerable to SQL injection is to demonstrate it. I'd suggest that you challenge the students to hack each others projects using SQL injection. You could then give bonus points for the students who are able to find the most vulnerabilities and for the students who didn't leave that attack vector open.That would be a fun way for students to learn by doing. This activity could also serve as an intro to what SQL injection is. Students could discover what SQL injection is themselves, and have a fun time doing it while also getting feedback on how their own code is weak.You could then go on to discuss the broader consequences of SQL injection with the entire class and go into real life instances of SQL injection vulnerabilities.