Introduction to Computer Science YMT113 · Fall 2026 Assoc. Prof. Ferhat Uçar
11 Python · AI · SQL Monday, November 30, 2026

SQL: The Language of Data

Flat files and their limits, relational databases, and SQL: creating tables, inserting, selecting, joining, indexing. Plus the two bugs every backend engineer must know: race conditions and SQL injection.

CS50Week 7 · SQL ReadCS50 notes; SQLite tutorial >_ Lab 9: Query the World

Before class · do this at home

Watch, read, then come

CS50x 2026 · Week 7: SQL by David J. Malan. Watch the lecture on YouTube (you are also enrolled on edX), read the notes, skim the slides. Our lecture builds on it instead of repeating it.

  • Watch the lecture with the favorites.db example open in sqlite3 in your codespace; type each query as it appears.
  • Project prototype check-in is today in the lab: tag your repository m3-prototype before 15:00.

Learning objectives

By the end of this week you can:

  • 1 Read and write CSV files from Python and explain why flat files do not scale.
  • 2 Design a table with types, primary keys and foreign keys, and normalize a many-to-many relationship.
  • 3 Write SELECT queries with WHERE, ORDER BY, GROUP BY, LIMIT and JOIN.
  • 4 Explain what an index is and why it makes queries fast (week 5 and 7, again).
  • 5 Describe race conditions and transactions.
  • 6 Explain SQL injection and prevent it with parameterized queries.

★ the wow moment

‘Robert’); DROP TABLE Students;--’ is a real attack, and one line of code stops it.

SQL injection is when user input is pasted into a query as text, so an attacker's input becomes part of the command. It has drained bank databases, leaked millions of passwords and topped the OWASP list for twenty years. The fix is to pass the input as a parameter, never as a string. Today you see the attack work on a toy database, and then you make it fail.

Topics

  1. Flat files: CSV with Python’s csv module, counting with a dict, and where it breaks (duplication, inconsistency, speed).
  2. Relational databases: tables, rows, columns, types (INTEGER, REAL, TEXT, BLOB), CREATE TABLE, primary and foreign keys.
  3. CRUD: INSERT, SELECT, UPDATE, DELETE; WHERE, LIKE, ORDER BY, GROUP BY, LIMIT, aggregate functions.
  4. Relationships: one-to-many and many-to-many, join tables, JOIN.
  5. Indexes: CREATE INDEX, B-trees, the timing difference on a large table.
  6. Python + SQL: the cs50 and sqlite3 libraries, parameterized queries.
  7. Two classic bugs: race conditions and transactions; SQL injection and its prevention.

Full notes are published before the lecture. The lab, Lab 9: Query the World, designs a schema, loads a CSV, answers questions with joins, and demonstrates and fixes an injection.

In industry

  • SQL is the most used language after English

    Every backend developer, data analyst, product manager and scientist writes SQL. It is the one language in this course you are guaranteed to use in any job.

  • SQLite is in your pocket

    The database we use is inside every iPhone and Android phone, every browser and most apps: the most deployed software on Earth, and it is written in C.

  • Indexes are why apps feel fast

    A B-tree index turns a full-table scan into binary search. The first thing a senior engineer checks on a slow query is the index.

  • Race conditions cost real money

    Two requests decrementing the same stock count at once sold the same concert seat twice. Transactions and locks are how banks and ticket systems stay sane.

Lab 9: Query the World

Design tables for a real CSV, load it into SQLite, answer questions with SELECT and JOIN, add an index, and demonstrate and fix an SQL injection. SQL + Python · due Fri, Dec 4 · 23:59 · 10 points · opens in week 11 Open lab instructions →

Go deeper

Tags:SQLSQLitedatabasetableprimary keyforeign keyJOINindextransactionrace conditionSQL injection