Fixing SQL injection vulnerability

FAForever · Oct 26, 2015 · 0881cbc · 0881cbc
1 parent 2db4c52
commit 0881cbc
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/api/achievements.py b/api/achievements.py
@@ -304,7 +304,7 @@ def achievements_list_player(player_id):
                             UNIX_TIMESTAMP(create_time) as create_time,
                             UNIX_TIMESTAMP(update_time) as update_time
                         FROM player_achievements
-                        WHERE player_id = '%s'""" % player_id)
+                        WHERE player_id = %s""", player_id)
 
         return flask.jsonify(items=cursor.fetchall())