Code reviewHardcr-g437

Subject Sql injectionLevel Senior–Staff~22 minCommon in Security · Databases & SQL interviewsIndustries Software development

Question

Review this Python user-search endpoint using parameterized SQL.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewpython

1@app.route('/admin/users/search')2@require_admin3def search_users():4    term = request.args.get('q', '')5    conn = get_db()6    cur = conn.cursor()7    pattern = '%' + term + '%'8    cur.execute(9        "SELECT id, email FROM users WHERE email LIKE %s ORDER BY email LIMIT 50",10        (pattern,),11    )12    rows = cur.fetchall()13    return jsonify([{'id': r[0], 'email': r[1]} for r in rows])

Run or narrate your approach, then ask the coach.