← Back to challenges

Injection II: Using Eval

PythonHardlogicgamesdata_structures

Instructions

The bookstore from [this collection] (https://innokodakademija.com/collection/dnXtkLPZpX25t227q), in a desperate attempt to avoid getting hacked, changed from exec() to eval(). Create a query that stores the users dictionary in the res variable.

Examples

param = "your text here"

users = {
  "user1": "password",
  "user2": "password"
}

res = eval('search("%s")' % param)

print(res) ➞ users

Notes

  • Create a string, not a function.
  • The site dictionary and search function have been gutted/deleted for brevity.
python3
Loading editor…
to run
Walks through the solution with reasoning and edge cases.