yashbidasaria / harry-s-list-friends Goto Github PK

Hello,

I noticed that some of the SQL queries are not sanitized properly, which opens a possibility of SQL Injection attacks (https://www.owasp.org/index.php/SQL_Injection).

As a Proof of Concept consider: http://localhost:search/q='+or+1=1+--+

Vulnerable lines in views.py are: 128, 133, 137, 150, 178, 207.

To fix those, i would suggest using prepared statements. For example, lines 132-133 can be rewritten to:
query = "SELECT DISTINCT Artist.Image_Src, Artist.Name, Artist.Location FROM Artist WHERE Artist.Name LIKE '%?%' LIMIT 30"
cursor.execute(query, (search_input))