why are f strings vulnerable to SQL injection but the % operator (for strings, not modulo) isn’t?
@cam that sounds wrong to me but i am not a python ninja so there could be some subtle shit i am not aware of
@wallhackio to be fair the best practice is to use prepared statements anyway
@wallhackio idk where I first heard it I’ve just heard that python f strings are vulnerable to sql injection but string substitution with % isn’t