mirror of
https://github.com/github/codeql.git
synced 2025-12-21 11:16:30 +01:00
19 lines
763 B
Python
19 lines
763 B
Python
from django.db import connection, models
|
|
|
|
|
|
def test_plain(username):
|
|
# GOOD -- Using parameters
|
|
connection.cursor().execute("SELECT * FROM users WHERE username = %s", username) # $getSql="SELECT * FROM users WHERE username = %s"
|
|
|
|
# BAD -- Using string formatting
|
|
connection.cursor().execute("SELECT * FROM users WHERE username = '%s'" % username) # $getSql=BinaryExpr
|
|
|
|
|
|
def test_context(username):
|
|
with connection.cursor() as cursor:
|
|
# GOOD -- Using parameters
|
|
cursor.execute("SELECT * FROM users WHERE username = %s", username) # $getSql="SELECT * FROM users WHERE username = %s"
|
|
|
|
# BAD -- Using string formatting
|
|
cursor.execute("SELECT * FROM users WHERE username = '%s'" % username) # $getSql=BinaryExpr
|