SQL injection
User-provided inputs must be sanitized before being used to generate a SQL database query. An attacker can create and use untrusted input to run query statements that read, modify, or delete database content.
def execute_query_noncompliant(request):
    import sqlite3
    name = request.GET.get("name")
    query = "SELECT * FROM Users WHERE name = " + name + ";"
    with sqlite3.connect("example.db") as connection:
        cursor = connection.cursor()
        # Noncompliant: user input is used without sanitization.
        cursor.execute(query)
        connection.commit()
        connection.close()
def execute_query_compliant(request):
    import re
    import sqlite3
    name = request.GET.get("name")
    query = "SELECT * FROM Users WHERE name = "
    + re.sub('[^a-zA-Z]+', '', name) + ";"
    with sqlite3.connect("example.db") as connection:
        cursor = connection.cursor()
        # Compliant: user input is sanitized before use.
        cursor.execute(query)
        connection.commit()
        connection.close()