Students building websites in a high-school computer science major (using
MySQL) don't seem to understand the dangers of SQL injections. I try to explain that unchecked SQL statements can really ruin their databases, but just telling them doesn't get the message through.
The students build small websites as a project, and they work on that project for one semester (they do this during the 2nd semester. In the first one they are taught
MySQL. Rather efficient, isn't it?).
The project guidelines specify they need login and registration pages, and a users database (among other requirements). After teaching how a login\sign up page might work I explain a bit about SQL injection. However, the students simply don't see the dangers SQL injection poses. I explain that I can cause the entire
users table to be deleted just by signing in, but just saying it apparently isn't enough.
So, how can I demonstrate the dangers of SQL injection?
Note: This isn't a self-learning question (details can be found in the comments).