SQL sanitization

ClinGen · Jul 2, 2024 · 4607e3e · 4607e3e
1 parent 749fd68
commit 4607e3e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/affiliation.py b/src/affiliation.py
@@ -67,10 +67,10 @@ def get_by_id(cls, id_) -> Optional['Affiliation']:
         con = sqlite3.connect(DB_FILE)  # type: ignore
         cur = con.cursor()
         try:
-            cur.execute(f"SELECT * FROM affiliations WHERE id = {id_}")
+            cur.execute("SELECT * FROM affiliations WHERE id = ?", (id_, ))
             result = cur.fetchone()
         except sqlite3.Error as err:
-            logger.error("Unable to get all affiliations")
+            logger.error("Unable to get affiliation by ID")
             logger.error("Error code: %s", err.sqlite_errorcode)
             logger.error("Error name: %s", err.sqlite_errorname)
             con.rollback()