User search by email

Code reviewSecurityDatabases & SQLSenior–Staff~22 min

Review this Python user-search endpoint using parameterized SQL.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 22 min

Mark a line and say what kind of problem it is.0 findings

1@app.route('/admin/users/search')

2@require_admin

3def search_users():

4 term = request.args.get('q', '')

5 conn = get_db()

6 cur = conn.cursor()

7 pattern = '%' + term + '%'

8 cur.execute(

9 "SELECT id, email FROM users WHERE email LIKE %s ORDER BY email LIMIT 50",

10 (pattern,),

11 )

12 rows = cur.fetchall()

13 return jsonify([{'id': r[0], 'email': r[1]} for r in rows])

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.