@@ -29,16 +29,14 @@ def find_users_query_v1(name: str) -> str:
2929 return f"SELECT * FROM users WHERE name = '{name}'"
3030
3131
32- # Uncomment for Python 3.14:
33- #
34- # def find_users_query_v2(name: str) -> Template:
35- # """Return a SQL query to find users by name."""
36- # return t"SELECT * FROM users WHERE name = '{name}'"
37- #
38- #
39- # def find_users(name: str) -> SQLQuery:
40- # """Return a SQL query to find users by name."""
41- # return SQLQuery(t"SELECT * FROM users WHERE name = {name}")
32+ def find_users_query_v2(name: str) -> Template:
33+ """Return a SQL query to find users by name."""
34+ return t"SELECT * FROM users WHERE name = '{name}'"
35+
36+
37+ def find_users(name: str) -> SQLQuery:
38+ """Return a SQL query to find users by name."""
39+ return SQLQuery(t"SELECT * FROM users WHERE name = {name}")
4240
4341
4442def render(template: Template) -> str:
@@ -63,16 +61,14 @@ def safer_render(template: Template) -> str:
6361 # Insecure f-strings
6462 print(find_users_query_v1("' OR '1'='1"))
6563
66- # Uncomment for Python 3.14:
67- #
68- # # More secure t-strings
69- # print(find_users_query_v2("' OR '1'='1"))
70- #
71- # # Insecure way of rendering t-strings into plain strings
72- # print(render(find_users_query_v2("' OR '1'='1")))
73- #
74- # # More secure way of rendering t-strings
75- # print(safer_render(find_users_query_v2("' OR '1'='1")))
76- #
77- # # Rendering t-strings into an alternative representation
78- # print(find_users("' OR '1'='1"))
64+ # More secure t-strings
65+ print(find_users_query_v2("' OR '1'='1"))
66+
67+ # Insecure way of rendering t-strings into plain strings
68+ print(render(find_users_query_v2("' OR '1'='1")))
69+
70+ # More secure way of rendering t-strings
71+ print(safer_render(find_users_query_v2("' OR '1'='1")))
72+
73+ # Rendering t-strings into an alternative representation
74+ print(find_users("' OR '1'='1"))
0 commit comments