String concatenation in SQL

Code reviewSecurityDatabases & SQLMid–Senior~25 min

Review this Python (Flask + psycopg2) endpoint.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1@app.route('/orders')

2def orders():

3 status = request.args.get('status', 'open')

4 sort = request.args.get('sort', 'created_at')

5 cur = db.cursor()

6 query = (

7 "SELECT id, total, created_at FROM orders "

8 "WHERE user_id = %s AND status = '" + status + "' "

9 "ORDER BY " + sort + " DESC"

10 )

11 cur.execute(query, (g.user_id,))

12 return jsonify(cur.fetchall())

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.