SQL injection from untrusted request data interpolated into raw SQL strings

[lorenz-MotionGraphics]

Risk: SQL injection could expose or modify data, run unauthorized queries, and bypass authorization, compromising database integrity and confidentiality.

developer note: The code is vibe-coded, but the raw SQL data is open to everyone. Just a heads-up: no commercial use unless you ask me first!.

Cause: Untrusted values are interpolated into SQL strings and executed via Connection.execute, allowing crafted input to alter the SQL structure.

Fix
Use parameterized queries with sqlalchemy.text() and named parameters. Example: stmt = text('SELECT * FROM users WHERE id=:id'); conn.execute(stmt, {'id': user_id}). For complex queries, use SQL Expression Language or the ORM. Never use +, %, format, or f-strings to build SQL.

Locations
4
lorenz-MotionGraphics/Event-Booking-Application
admin.py
Line 67
    if sort_col:
        query += f" ORDER BY {sort_col} {sort_order}"

    cursor.execute(query, params)
    rows = cursor.fetchall()
    conn.close()
    return rows

lorenz-MotionGraphics/Event-Booking-Application
admin.py
Line 76
    conn = sqlite3.connect(db_name)
    cursor = conn.cursor()
    placeholders = ', '.join(['?'] * len(values))
    cursor.execute(f"INSERT INTO {table_name} ({columns}) VALUES ({placeholders})", values)
    conn.commit()
    conn.close()

lorenz-MotionGraphics/Event-Booking-Application
admin.py
Line 83
def update_data(db_name, table_name, set_clause, condition, values):
    conn = sqlite3.connect(db_name)
    cursor = conn.cursor()
    cursor.execute(f"UPDATE {table_name} SET {set_clause} WHERE {condition}", values)
    conn.commit()
    conn.close()

lorenz-MotionGraphics/Event-Booking-Application
admin.py
Line 90
def delete_data(db_name, table_name, condition, value):
    conn = sqlite3.connect(db_name)
    cursor = conn.cursor()
    cursor.execute(f"DELETE FROM {table_name} WHERE {condition}", (value,))
    conn.commit()
    conn.close()