== How to fix it in databases

=== Code examples

include::../../common/fix/code-rationale.adoc[]

==== Noncompliant code example

[source,python,diff-id=31,diff-type=noncompliant]
----
from fastapi import APIRouter
router = APIRouter()

@router.get('/example')
async def  get_users(user: str):
    await database.fetch_all("SELECT user FROM users WHERE user = '" + user + "'") # Noncompliant
----

==== Compliant solution

[source,python,diff-id=31,diff-type=compliant]
----
from fastapi import APIRouter
router = APIRouter()

@router.get('/example')
async def  get_users(user: str):
    await database.fetch_all("SELECT user FROM users WHERE user = :user", values={'user':user}) # Compliant
----

=== How does this work?

include::../../common/fix/prepared-statements.adoc[]
