The SQL queries are build using the normal python string mechanisms and are therefore vulnerable to possible SQL injections. As a fix the Queries should make use of the bindValue() mechanism.
Log in to post a comment.