MediumPython
Parameterize SQL Query
PythonSecurityDatabases
The function below builds a SQL query by embedding user input directly into the string.
The bug: an attacker can pass "1' OR '1'='1" as user_id and dump the entire users table (or worse, DROP TABLE users).
Your task: fix solve(user_id) so it returns a parameterized query dict instead of a raw string:
# Expected return shape
{'sql': 'SELECT * FROM users WHERE id = %s', 'params': [user_id]}The sql string must use the %s placeholder (the standard Python DB-API convention). The user input must only ever appear in params — never embedded in the SQL string.
Sample tests
Test #1Basic numeric id
Input: ["42"]
Output: {"sql":"SELECT * FROM users WHERE id = %s","params":["42"]}
Test #2SQL injection attempt stays in params
Input: ["1' OR '1'='1"]
Output: {"sql":"SELECT * FROM users WHERE id = %s","params":["1' OR '1'='1"]}
Test #3String id with hyphen
Input: ["user-123"]
Output: {"sql":"SELECT * FROM users WHERE id = %s","params":["user-123"]}