The query that runs fine until someone types an apostrophe
A query built with an f-string or a `+` reads like ordinary code and passes every test - until a value carries an apostrophe, an `OR 1=1`, or a `;` and your database runs it as SQL. Here is the injection behind CWE-89, why parameterization is the only real fix, and sqlfence, a static linter that fails the build when a query is built from user input.
Sep 23, 20268 min read2
