3 ms·

That's the point. If the candidate doesn't know that that is a SQL injection, then you have a problem.