[P0/security] f-string SQL interpolation in pandas/dashboard recipes teaches injection patterns

[yeongseon]

Description

Multiple recipes use f-string interpolation with text() for DDL operations (DROP TABLE, CREATE TABLE). While the interpolated values are currently hardcoded constants, this pattern teaches users to combine f-strings with text() — directly contradicting the project rule "never use string interpolation for SQL."

Affected Files

Pandas recipes (6 files)

• fundamentals/pandas/01_read_sql.py:18,22
• fundamentals/pandas/02_read_sql_query_params.py
• fundamentals/pandas/03_clean_and_transform.py
• fundamentals/pandas/04_groupby_report.py
• fundamentals/pandas/05_to_sql_append_replace.py
• fundamentals/pandas/06_export_csv.py

Template recipes

• templates/api-service-fastapi/recipes/* (multiple files)
• templates/flask/* (multiple files)

Current code (example)

# fundamentals/pandas/01_read_sql.py
TABLE_NAME = "cookbook_pandas_demo"

with engine.connect() as conn:
    conn.execute(text(f"DROP TABLE IF EXISTS {TABLE_NAME}"))    # ← f-string in text()
    conn.execute(text(f"CREATE TABLE {TABLE_NAME} (...)"))      # ← f-string in text()

Impact

Users who copy this pattern with user-supplied table names will introduce SQL injection. Cookbook recipes should teach the safest possible patterns.

Fix

Two options:

Option A (recommended): Use SQLAlchemy Core Table + MetaData for DDL:

metadata = MetaData()
demo_table = Table("cookbook_pandas_demo", metadata, ...)
metadata.drop_all(engine)  # safe, parameterized
metadata.create_all(engine)

Option B: Add prominent warning comments:

# WARNING: TABLE_NAME is a hardcoded constant. NEVER use f-string
# interpolation with text() for user-supplied values.
conn.execute(text(f"DROP TABLE IF EXISTS {TABLE_NAME}"))

Context

Found during line-by-line code review (2025-07-23).

[yeongseon]

Fixed in PR #34 (merged).