Fix the Login Lookup: SQL Injection

The staff portal at Harbourlight Freight builds its sign-in lookup by pasting the username and password into the statement text. Someone used that to open an administrator session they had no right to.

Your job is to make the lookup treat input as data and nothing else: switch the statement to a parameterised form, and add an input policy for the username field, which has a known shape. Staff and the administrator must still sign in with their real passwords, and a wrong password must still be refused.

Work through the bench tabs in order. Incident tells you what happened. Target shows the service and lets you use it as an ordinary user would. Fix is where you change the setting that caused the problem; the check table re-runs the platform's own test cases every time you save, and every row marked still works must stay green. Detect asks you to mark the log lines, or write a rule, that catch the misuse without flagging normal traffic. Explain asks a few short questions about why the fix works. When every step passes, Prove releases your flag.

Everything runs in a simulated, in-memory copy of the service built for you alone. The misuse cases are generated by the platform; you never need to write an attack, only the defence.