SQL injection (ARCH2100)

Key python.security.sql-injection · Severity error · Category security · CWE CWE-89

Embedding user input into a SQL query via concatenation or formatting lets an attacker alter the query structure and exfiltrate data. Use parameterized queries.

Incorrect

def get_user(cur, username):
    cur.execute("SELECT * FROM users WHERE name = '%s'" % username)
    return cur.fetchone()

Correct

def get_user(cur, username):
    cur.execute("SELECT * FROM users WHERE name = %s", (username,))
    return cur.fetchone()

Fix

Use parameterized queries (placeholders) or your ORM’s safe query API instead of interpolating input into the SQL string.