Use a parameterized query to prevent sql injection

onaio · Aug 13, 2024 · 20fb25c · 20fb25c
1 parent e9aece0
commit 20fb25c
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/tally_ho/apps/tally/management/commands/utils.py b/tally_ho/apps/tally/management/commands/utils.py
@@ -249,12 +249,14 @@ def check_duplicates(csv_file_path: str, field: str) -> None:
     """
     con = duckdb.connect()
 
-    result = con.execute(f"""
+    query = """
         SELECT {field}, COUNT(*) AS cnt
-        FROM read_csv_auto('{csv_file_path}')
+        FROM read_csv_auto(?)
         GROUP BY {field}
         HAVING cnt > 1
-    """).fetchall()
+    """.format(field=field)
+
+    result = con.execute(query, [csv_file_path]).fetchall()
 
     if len(result) > 0:
         raise Exception(f"Duplicates found for field '{field}'")