Lion Cipher Lab
Your first SQL queries: understand databases before you meet SQL injection
- AppSec / DevSecOps
- Beginner
- ~30 min
- Free · no account required
Why it matters
Almost every applied-security path eventually points you at a SQL-injection exercise, and almost none of them stop to make sure you can read a SQL query first. That is backwards. SQL injection is, at its core, a query that got built wrong — so the vulnerability is genuinely incomprehensible until you have written a few queries yourself and seen how they are put together. Databases also sit under nearly everything you will defend: web apps, logs, user accounts, asset inventories. Spend half an hour making a small table and asking it questions, and two things happen at once — the database stops…
What you'll learn
- what a database and table are
- writing SQL: CREATE, INSERT, SELECT, WHERE
- using SQLite with Python's built-in sqlite3
- reading how a query is structured
- parameter placeholders
- why understanding queries precedes understanding SQL injection
Steps in this lab
- What a database is, and why this comes before SQL injection
- Get a database engine with zero setup — it's already in Python
- Create a database file and a table (CREATE TABLE)
- Put a few rows in (INSERT INTO)
- Ask the table questions (SELECT, then filter with WHERE)
- The bridge: why building queries is step one to understanding SQL injection
- What you just built, and where it points