== How to fix it in Python SQLite

=== Code examples

include::../../common/fix/code-rationale.adoc[]

==== Noncompliant code example

[source,python,diff-id=11,diff-type=noncompliant]
----
from flask import request

@app.route('/example')
def get_users():
    user = request.args["user"]
    sql = """SELECT user FROM users WHERE user = \'%s\'"""

    conn = sqlite3.connect('example')
    conn.cursor().execute(sql % (user)) # Noncompliant
----

==== Compliant solution

[source,python,diff-id=11,diff-type=compliant]
----
from flask import request

@app.route('/example')
def get_users():
    user = request.args["user"]
    sql = """SELECT user FROM users WHERE user = (?)"""
    value = (user,)

    conn = sqlite3.connect('example')
    conn.cursor().execute(sql, value)
----

=== How does this work?

include::../../common/fix/prepared-statements.adoc[]
