Constructing SQL query using user provided data is insecure. It makes application vulnerable to SQL injection attacks. An SQL injection attack consists of the insertion or “injection” of an SQL query via the input data given to an application. It is a very common attack vector. Unless care is taken to sanitize and control the input data when building such SQL statement strings, an injection attack becomes possible. It is possible for an attacker to craft queries to read, modify, or delete sensitive information from the database and sometimes even shut it down or execute arbitrary operating system commands.

It is recommended to ensure that the user-provided data is properly escaped and validated. Modern database adapters come with built-in tools for preventing Python SQL injection by using query parameters.

Since this is an audit issue, some occurrences may be harmless here. The goal is to bring the issue to attention. Please make sure that the input string is trusted. If the occurrences don't seem to be valid, please feel free to ignore them.

Bad practice

cursor = connection.cursor()
cursor.execute("SELECT id FROM userdata WHERE Name =%s;" % name)  # Sensitve. Query constructed based on user's input

References:

SQL injection
SQL injection attacks with Python
OWASP Top 10 2021 Category A03 - Injection
SANS Top 25
CWE-20 - Improper input validation
CWE 89 - Improper Neutralization of Special Elements used in an SQL Command

Bad practice

Recommended

References:

KOSASIH / SilkRoad

No ignore rules found