[DB] SQL injection

[matiboy]

Briefly describe SQL injection
Is your current code protected against such attacks. If yes explain how, if no point to examples and suggest solutions/fixes

[ai550]

To put it simply, SQL Injection is a way to insert one's custom (and sometimes dangerous) query into a stream of executed queries.

[ai550]

The function get_user_by_id(id) in database.py is vulnerable to SQL Injection.
Solution/fix: use query data as a parameter in execute function.