sql-injection

server.py

from bottle import route, run, request

import MySQLdb

# connect
db = MySQLdb.connect(host="localhost", user="root", passwd="password", db="testing")
cursor = db.cursor()

@route('/users')
def hello():
    id = request.query.get("id")
    cursor.execute("SELECT * FROM users WHERE id=" + str(id))
    return str(cursor.fetchall())

run(host='0.0.0.0', port=8080, debug=True)