# Works for normal users — but trusts input completely
import sqlite3

def find_user(conn, username):
    query = f"SELECT id, name FROM users WHERE username = '{username}'"
    return conn.execute(query).fetchone()
# A crafted username can change the meaning of this query (SQL injection).

# Same feature with a parameterised query and input checks
import re
import sqlite3

USERNAME_RE = re.compile(r"^[a-zA-Z0-9_]{3,30}$")

def find_user(conn, username):
    if not USERNAME_RE.match(username):
        raise ValueError("Invalid username format")
    return conn.execute(
        "SELECT id, name FROM users WHERE username = ?", (username,)
    ).fetchone()

# Ticket: add a 'remember me' option to login
# Programmer focus: does it work for the user?
# - add checkbox to form
# - extend session lifetime when checked
# - write tests for both cases

def session_lifetime_days(remember_me: bool) -> int:
    return 30 if remember_me else 1

assert session_lifetime_days(True) == 30
assert session_lifetime_days(False) == 1

Review of the same 'remember me' feature
☐ Is the long-lived session token random and unguessable?
☐ Is the cookie set with Secure, HttpOnly and SameSite?
☐ Can the user see and revoke active sessions?
☐ Is the token invalidated on password change?
☐ Are unusual logins (new device, location) flagged?
Finding example: cookie missing HttpOnly → recommend setting it.

# Secure coding both fields agree on: never store plain passwords
# pip install bcrypt
import bcrypt

def hash_password(plain: str) -> bytes:
    return bcrypt.hashpw(plain.encode(), bcrypt.gensalt())

def check_password(plain: str, hashed: bytes) -> bool:
    return bcrypt.checkpw(plain.encode(), hashed)

h = hash_password("correct horse battery staple")
print(check_password("correct horse battery staple", h))  # True
print(check_password("wrong", h))                         # False

Tick what energises you
☐ Building something new from a blank file          → programming
☐ Finding the one input that breaks a system        → security
☐ Making features fast and elegant                  → programming
☐ Investigating what happened after an incident     → security
☐ Writing code that others rely on daily            → programming
☐ Reducing risk across many systems                 → security

Week 1 (programming): build a small Flask or Node app with login and a form
Week 2 (security):    review your own app — input validation, password storage,
                      session cookies, error messages; fix what you find
Reflect: which week did you enjoy more, and why?

☐ Parameterised queries for all database access
☐ Validate input type, length and format on the server
☐ Hash passwords with bcrypt or argon2
☐ Cookies set Secure, HttpOnly, SameSite
☐ No secrets in source code or logs
☐ Error messages do not reveal internals
☐ Dependencies kept up to date

Chosen field: ____
Why: ____
First 3 skills to build: ____, ____, ____
First project or lab: ____
Bridge skill from the other field: ____ (e.g. scripting or secure coding)