Untrusted user_id is concatenated into a raw SQL string. An attacker can append OR 1=1 or UNION SELECT and read other customers' orders.
Flagged code
query = f"SELECT * FROM orders WHERE user_id = '{user_id}' AND status = 'active'"
cursor.execute(query)Suggested fix
from sqlalchemy import text
stmt = text("SELECT * FROM orders WHERE user_id = :user_id AND status = 'active'")
cursor.execute(stmt, {"user_id": user_id})Test stub
def test_get_user_orders_rejects_injection(client):
response = client.get("/orders", params={"user_id": "1' OR '1'='1"})
assert response.status_code in {400, 404}