The Life Starter
0 of 6 complete0%
Course Library · Lesson 5 of 6
Digital · Guided lesson

Use parameters instead of concatenation

About 19 minutes · 4 reading + 15 practice and checks
Time includes reading, practice, and questions. Extra videos or further study are optional.
See this course’s project requirements

A local SQLite seat-transfer exercise with before/after totals, an all-or-nothing update, a deliberately rejected change and rollback evidence.

Keep your working files in your own notebook or software. Save a private description, checklist, and work link in My Proof.

What to include

  • A seat-transfer contract with total 10 preserved.
  • Two targeted updates with a declared completion boundary.
  • A committed all-or-nothing transfer record.
  • A 5, B 5 and no active transaction after rejection.
  • A parameterized update/lookup record with known-ID validation.
  • A checked seat-transfer transaction packet.

Review and revise

Use these criteria to check your work and choose what to improve.

  • The implementation or declared simulation follows the supplied contract and retains inspectable original inputs.
  • Normal, boundary and rejected cases are recorded with expected versus observed results.
  • The changed case has a correct explanation and does not rely on hidden state.
  • The project includes source, outputs, instructions and honest tool, privacy and verification limits.
Open the full course project
Want more background?
Before you begin

The idea in everyday life

The code calls SELECT quantity FROM seats WHERE group_id=? with tuple(source,). A fictional id containing quotes is treated as a value and not found.

The idea

Parameter binding passes values separately from SQL syntax. It does not authorize an operation or validate business rules; it prevents text values from being interpreted as part of the query structure.

Follow along

Use parameters instead of concatenation — original worked practice

Parameter binding passes values separately from SQL syntax. It does not authorize an operation or validate business rules; it prevents text values from being interpreted as part of the query structure.

The code calls SELECT quantity FROM seats WHERE group_id=? with tuple(source,). A fictional id containing quotes is treated as a value and not found.

  1. 1. Step 1

    Find the ? placeholder and the value tuple.

    You should see: SQL structure and group value are separate.

    This keeps the rule and its observable result together.

  2. 2. Step 2

    Compare with string concatenation and list the risk.

    You should see: Untrusted text could otherwise alter query syntax.

    This keeps the rule and its observable result together.

  3. 3. Step 3

    Try the unknown-ID case Z.

    You should see: A parameterized lookup returns no match; validation rejects it.

    This keeps the rule and its observable result together.

  4. 4. Step 4

    Keep binding and business validation as distinct checks.

    You should see: A parameterized update/lookup record with known-ID validation.

    This keeps the rule and its observable result together.

Now change one thing

Recreate the fresh A=8, B=2 fixture. Bind source A, target B and count 2 as separate parameter values, then perform the complete transfer. Enter the final B quantity.

Your work

What to finish

A parameterized update/lookup record with known-ID validation.

Common mistake

Watch for this

Building SQL by concatenating an identifier into source text instead of binding it as data.

How can I tell I understand it?

Explain and demonstrate the required distinction: Parameter binding passes values separately from SQL syntax. It does not authorize an operation or validate business rules; it prevents text values from being interpreted as part of the query structure. Show a changed input and the expected result without weakening this contract.

Try 3 questions

Quick knowledge check

Answer all 3 questions. Get at least 2 right and the lesson completes automatically.

Not yet passed

You’ll get an explanation for each answer. Signed in? Your results save to your account.

1What does a ? placeholder represent?
2Does parameter binding guarantee an ID exists?
3Which approach should this code use?
0 of 3 answeredApply the lesson to a short question, then review the explanation.
5
Finish this lesson

Pass the check. We’ll save the progress.

Answer all 3 questions above and get at least 2 right. You can review the explanations and try again.

Go to the knowledge check
Tools, templates, and lesson sources

Tools and templates

Tools open in a new tab so you can keep your place here.

Sources and further reading

Explore the references behind this lesson.

www.sqlite.org — lang_update.html
Source & access notes · checked 2026-10-01

Relevant documented module/API behavior inspected during expansion authoring; actual execution evidence is recorded separately. No grant eligibility is established.

Access: Official page retrieved with the web reader on 2026-10-01. Documentation reading does not certify execution in every native tool or browser.

Reuse: Original local practice files, fictional data, worked examples and questions. Concepts paraphrased and linked; source exercises are not copied.

docs.python.org — sqlite 3.html
Source & access notes · checked 2026-10-01

Relevant documented module/API behavior inspected during expansion authoring; actual execution evidence is recorded separately. No grant eligibility is established.

Access: Official page retrieved with the web reader on 2026-10-01. Documentation reading does not certify execution in every native tool or browser.

Reuse: Original local practice files, fictional data, worked examples and questions. Concepts paraphrased and linked; source exercises are not copied.

Report a problem with this lesson

Tell us what went wrong. Please leave out personal information and private project contents.

No sign-in needed.