Are Python prepared statements vulnerable to SQL injection | Shouland

You are using the string formatting operator instead of bound SQL parameters, so your code is indeed at risk of SQL injection (once you fix the $s …