Code RoomSort column injection

MediumPrep Room Coding #1890

Sort column injection

Code reviewSecurityDatabases & SQLMid–Senior~25 min

Review this Python listing query that parameterizes the filter but not the sort.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1def list_products(category: str, sort_col: str, direction: str, cur):

2 cur.execute(

3 "SELECT * FROM products WHERE category = %s "

4 f"ORDER BY {sort_col} {direction}",

5 (category,),

6 )

7 return cur.fetchall()

8# sort_col / direction come straight from query-string params

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.