diff --git a/index.py b/index.py index 83759b9..a40e903 100644 --- a/index.py +++ b/index.py @@ -8,7 +8,21 @@ def get_data_by_config_value(value): # This might look suspicious due to string concatenation with values from CONFIG. - query = "SELECT * FROM " + CONFIG["default_table"] + " WHERE " + CONFIG["default_column"] + " = '" + value + "'" + """Retrieves data from a database based on a specified configuration value. + + Args: + value (str): The value to match in the database query. + + Returns: + list: A list of tuples containing the query results. + + Raises: + sqlite3.Error: If there is an issue with the database connection or query execution. + + Note: + This method uses string concatenation to build the SQL query, which may be vulnerable + to SQL injection attacks. It is recommended to use parameterized queries instead. + """ query = "SELECT * FROM " + CONFIG["default_table"] + " WHERE " + CONFIG["default_column"] + " = '" + value + "'" connection = sqlite3.connect("database.db") cursor = connection.cursor()