defget_user(request):user_id=request.params["id"]# Unsafe: user input concatenated straight into the query.
returndb.query("SELECT*FROM users WHERE id ="+user_id)defget_user_safe(request):user_id=request.params["id"]# Safe: parameterized query.
returndb.query("SELECT*FROM users WHERE id = ?",[user_id])