Spec an injection-proof search with a chosen sort

Your admin tool needs a customer search page in Python over Postgres. Staff type a keyword that matches names and emails, then pick a sort column and direction from a dropdown. The dropdown values arrive as plain query parameters, so anyone can send anything. An agent will write the search function.

Write the spec you would hand the agent.

What you know:

• psycopg 3, and the table is customers(id, name, email, created_at, lifetime_value, password_hash)
• the dropdown offers name, created date and lifetime value, each ascending or descending
• staff search for strings like o'neil, 50% and first_last
• results are paged 50 at a time

Then, in a few sentences: what does "build the query from the keyword and the sort column" get wrong, even after the agent says it used parameters?