== How to fix it in SQLAlchemy

=== Code examples

include::../../common/fix/code-rationale.adoc[]

==== Noncompliant code example

[source,python,diff-id=1,diff-type=noncompliant]
----
from flask import request
import sqlalchemy

@app.route('/example')
def get_users():
    user = request.args["user"]
    engine = sqlalchemy.create_engine(connection_string)
    conn = engine.connect()

    conn.execute("SELECT user FROM users WHERE user = '" + user + "'") # Noncompliant
----

==== Compliant solution

[source,python,diff-id=1,diff-type=compliant]
----
from flask import request
import sqlalchemy

@app.route('/example')
def get_users():
    user = request.args["user"]
    engine = sqlalchemy.create_engine(connection_string)
    metadata = sqlalchemy.MetaData(bind=conn, reflect=True)
    users = metadata.tables['users']
    conn = engine.connect()

    sql = users.select().where(users.c.user == user)
    conn.execute(sql)
----

=== How does this work?

:secure_feature: SQLAlchemy
:unsafe_function: sqlalchemy.text()

include::../../common/fix/secure-by-design.adoc[]
