---
source: crates/ruff_linter/src/rules/flake8_bandit/mod.rs
---
S608 Possible SQL injection vector through string-based query construction
 --> S608.py:2:10
  |
1 | # single-line failures
2 | query1 = "SELECT %s FROM table" % (var,) # bad
  |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
3 | query2 = "SELECT var FROM " + table
4 | query3 = "SELECT " + val + " FROM " + table
  |

S608 Possible SQL injection vector through string-based query construction
 --> S608.py:3:10
  |
1 | # single-line failures
2 | query1 = "SELECT %s FROM table" % (var,) # bad
3 | query2 = "SELECT var FROM " + table
  |          ^^^^^^^^^^^^^^^^^^^^^^^^^^
4 | query3 = "SELECT " + val + " FROM " + table
5 | query4 = "SELECT {} FROM table;".format(var)
  |

S608 Possible SQL injection vector through string-based query construction
 --> S608.py:4:10
  |
2 | query1 = "SELECT %s FROM table" % (var,) # bad
3 | query2 = "SELECT var FROM " + table
4 | query3 = "SELECT " + val + " FROM " + table
  |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
5 | query4 = "SELECT {} FROM table;".format(var)
6 | query5 = f"SELECT * FROM table WHERE var = {var}"
  |

S608 Possible SQL injection vector through string-based query construction
 --> S608.py:5:10
  |
3 | query2 = "SELECT var FROM " + table
4 | query3 = "SELECT " + val + " FROM " + table
5 | query4 = "SELECT {} FROM table;".format(var)
  |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
6 | query5 = f"SELECT * FROM table WHERE var = {var}"
  |

S608 Possible SQL injection vector through string-based query construction
 --> S608.py:6:10
  |
4 | query3 = "SELECT " + val + " FROM " + table
5 | query4 = "SELECT {} FROM table;".format(var)
6 | query5 = f"SELECT * FROM table WHERE var = {var}"
  |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
7 |
8 | query6 = "DELETE FROM table WHERE var = %s" % (var,)
  |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:8:10
   |
 6 | query5 = f"SELECT * FROM table WHERE var = {var}"
 7 |
 8 | query6 = "DELETE FROM table WHERE var = %s" % (var,)
   |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 9 | query7 = "DELETE FROM table WHERE VAR = " + var
10 | query8 = "DELETE FROM " + table + "WHERE var = " + var
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:9:10
   |
 8 | query6 = "DELETE FROM table WHERE var = %s" % (var,)
 9 | query7 = "DELETE FROM table WHERE VAR = " + var
   |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
10 | query8 = "DELETE FROM " + table + "WHERE var = " + var
11 | query9 = "DELETE FROM table WHERE var = {}".format(var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:10:10
   |
 8 | query6 = "DELETE FROM table WHERE var = %s" % (var,)
 9 | query7 = "DELETE FROM table WHERE VAR = " + var
10 | query8 = "DELETE FROM " + table + "WHERE var = " + var
   |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
11 | query9 = "DELETE FROM table WHERE var = {}".format(var)
12 | query10 = f"DELETE FROM table WHERE var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:11:10
   |
 9 | query7 = "DELETE FROM table WHERE VAR = " + var
10 | query8 = "DELETE FROM " + table + "WHERE var = " + var
11 | query9 = "DELETE FROM table WHERE var = {}".format(var)
   |          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
12 | query10 = f"DELETE FROM table WHERE var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:12:11
   |
10 | query8 = "DELETE FROM " + table + "WHERE var = " + var
11 | query9 = "DELETE FROM table WHERE var = {}".format(var)
12 | query10 = f"DELETE FROM table WHERE var = {var}"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
13 |
14 | query11 = "INSERT INTO table VALUES (%s)" % (var,)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:14:11
   |
12 | query10 = f"DELETE FROM table WHERE var = {var}"
13 |
14 | query11 = "INSERT INTO table VALUES (%s)" % (var,)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
15 | query12 = "INSERT INTO TABLE VALUES (" + var + ")"
16 | query13 = "INSERT INTO {} VALUES ({})".format(table, var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:15:11
   |
14 | query11 = "INSERT INTO table VALUES (%s)" % (var,)
15 | query12 = "INSERT INTO TABLE VALUES (" + var + ")"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
16 | query13 = "INSERT INTO {} VALUES ({})".format(table, var)
17 | query14 = f"INSERT INTO {table} VALUES var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:16:11
   |
14 | query11 = "INSERT INTO table VALUES (%s)" % (var,)
15 | query12 = "INSERT INTO TABLE VALUES (" + var + ")"
16 | query13 = "INSERT INTO {} VALUES ({})".format(table, var)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
17 | query14 = f"INSERT INTO {table} VALUES var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:17:11
   |
15 | query12 = "INSERT INTO TABLE VALUES (" + var + ")"
16 | query13 = "INSERT INTO {} VALUES ({})".format(table, var)
17 | query14 = f"INSERT INTO {table} VALUES var = {var}"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
18 |
19 | query15 = "UPDATE %s SET var = %s" % (table, var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:19:11
   |
17 | query14 = f"INSERT INTO {table} VALUES var = {var}"
18 |
19 | query15 = "UPDATE %s SET var = %s" % (table, var)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
20 | query16 = "UPDATE " + table + " SET var = " + var
21 | query17 = "UPDATE {} SET var = {}".format(table, var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:20:11
   |
19 | query15 = "UPDATE %s SET var = %s" % (table, var)
20 | query16 = "UPDATE " + table + " SET var = " + var
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
21 | query17 = "UPDATE {} SET var = {}".format(table, var)
22 | query18 = f"UPDATE {table} SET var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:21:11
   |
19 | query15 = "UPDATE %s SET var = %s" % (table, var)
20 | query16 = "UPDATE " + table + " SET var = " + var
21 | query17 = "UPDATE {} SET var = {}".format(table, var)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
22 | query18 = f"UPDATE {table} SET var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:22:11
   |
20 | query16 = "UPDATE " + table + " SET var = " + var
21 | query17 = "UPDATE {} SET var = {}".format(table, var)
22 | query18 = f"UPDATE {table} SET var = {var}"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
23 |
24 | query19 = "select %s from table" % (var,)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:24:11
   |
22 | query18 = f"UPDATE {table} SET var = {var}"
23 |
24 | query19 = "select %s from table" % (var,)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
25 | query20 = "select var from " + table
26 | query21 = "select " + val + " from " + table
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:25:11
   |
24 | query19 = "select %s from table" % (var,)
25 | query20 = "select var from " + table
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^
26 | query21 = "select " + val + " from " + table
27 | query22 = "select {} from table;".format(var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:26:11
   |
24 | query19 = "select %s from table" % (var,)
25 | query20 = "select var from " + table
26 | query21 = "select " + val + " from " + table
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
27 | query22 = "select {} from table;".format(var)
28 | query23 = f"select * from table where var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:27:11
   |
25 | query20 = "select var from " + table
26 | query21 = "select " + val + " from " + table
27 | query22 = "select {} from table;".format(var)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
28 | query23 = f"select * from table where var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:28:11
   |
26 | query21 = "select " + val + " from " + table
27 | query22 = "select {} from table;".format(var)
28 | query23 = f"select * from table where var = {var}"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
29 |
30 | query24 = "delete from table where var = %s" % (var,)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:30:11
   |
28 | query23 = f"select * from table where var = {var}"
29 |
30 | query24 = "delete from table where var = %s" % (var,)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
31 | query25 = "delete from table where var = " + var
32 | query26 = "delete from " + table + "where var = " + var
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:31:11
   |
30 | query24 = "delete from table where var = %s" % (var,)
31 | query25 = "delete from table where var = " + var
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
32 | query26 = "delete from " + table + "where var = " + var
33 | query27 = "delete from table where var = {}".format(var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:32:11
   |
30 | query24 = "delete from table where var = %s" % (var,)
31 | query25 = "delete from table where var = " + var
32 | query26 = "delete from " + table + "where var = " + var
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
33 | query27 = "delete from table where var = {}".format(var)
34 | query28 = f"delete from table where var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:33:11
   |
31 | query25 = "delete from table where var = " + var
32 | query26 = "delete from " + table + "where var = " + var
33 | query27 = "delete from table where var = {}".format(var)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
34 | query28 = f"delete from table where var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:34:11
   |
32 | query26 = "delete from " + table + "where var = " + var
33 | query27 = "delete from table where var = {}".format(var)
34 | query28 = f"delete from table where var = {var}"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
35 |
36 | query29 = "insert into table values (%s)" % (var,)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:36:11
   |
34 | query28 = f"delete from table where var = {var}"
35 |
36 | query29 = "insert into table values (%s)" % (var,)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
37 | query30 = "insert into table values (" + var + ")"
38 | query31 = "insert into {} values ({})".format(table, var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:37:11
   |
36 | query29 = "insert into table values (%s)" % (var,)
37 | query30 = "insert into table values (" + var + ")"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
38 | query31 = "insert into {} values ({})".format(table, var)
39 | query32 = f"insert into {table} values var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:38:11
   |
36 | query29 = "insert into table values (%s)" % (var,)
37 | query30 = "insert into table values (" + var + ")"
38 | query31 = "insert into {} values ({})".format(table, var)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
39 | query32 = f"insert into {table} values var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:39:11
   |
37 | query30 = "insert into table values (" + var + ")"
38 | query31 = "insert into {} values ({})".format(table, var)
39 | query32 = f"insert into {table} values var = {var}"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
40 |
41 | query33 = "update %s set var = %s" % (table, var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:41:11
   |
39 | query32 = f"insert into {table} values var = {var}"
40 |
41 | query33 = "update %s set var = %s" % (table, var)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
42 | query34 = "update " + table + " set var = " + var
43 | query35 = "update {} set var = {}".format(table, var)
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:42:11
   |
41 | query33 = "update %s set var = %s" % (table, var)
42 | query34 = "update " + table + " set var = " + var
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
43 | query35 = "update {} set var = {}".format(table, var)
44 | query36 = f"update {table} set var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:43:11
   |
41 | query33 = "update %s set var = %s" % (table, var)
42 | query34 = "update " + table + " set var = " + var
43 | query35 = "update {} set var = {}".format(table, var)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
44 | query36 = f"update {table} set var = {var}"
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:44:11
   |
42 | query34 = "update " + table + " set var = " + var
43 | query35 = "update {} set var = {}".format(table, var)
44 | query36 = f"update {table} set var = {var}"
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
45 |
46 | # multi-line failures
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:48:12
   |
46 |   # multi-line failures
47 |   def query37():
48 |       return """
   |  ____________^
49 | |     SELECT *
50 | |     FROM table
51 | |     WHERE var = %s
52 | |     """ % var
   | |_____________^
53 |
54 |   def query38():
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:55:12
   |
54 |   def query38():
55 |       return """
   |  ____________^
56 | |     SELECT *
57 | |     FROM TABLE
58 | |     WHERE var =
59 | |     """ + var
   | |_____________^
60 |
61 |   def query39():
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:62:12
   |
61 |   def query39():
62 |       return """
   |  ____________^
63 | |     SELECT *
64 | |     FROM table
65 | |     WHERE var = {}
66 | |     """.format(var)
   | |___________________^
67 |
68 |   def query40():
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:69:12
   |
68 |   def query40():
69 |       return f"""
   |  ____________^
70 | |     SELECT *
71 | |     FROM table
72 | |     WHERE var = {var}
73 | |     """
   | |_______^
74 |
75 |   def query41():
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:77:9
   |
75 |   def query41():
76 |       return (
77 | /         "SELECT * "
78 | |         "FROM table "
79 | |         f"WHERE var = {var}"
   | |____________________________^
80 |       )
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:83:26
   |
82 | # # cursor-wrapped failures
83 | query42 = cursor.execute("SELECT * FROM table WHERE var = %s" % var)
   |                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
84 | query43 = cursor.execute(f"SELECT * FROM table WHERE var = {var}")
85 | query44 = cursor.execute("SELECT * FROM table WHERE var = {}".format(var))
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:84:26
   |
82 | # # cursor-wrapped failures
83 | query42 = cursor.execute("SELECT * FROM table WHERE var = %s" % var)
84 | query43 = cursor.execute(f"SELECT * FROM table WHERE var = {var}")
   |                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
85 | query44 = cursor.execute("SELECT * FROM table WHERE var = {}".format(var))
86 | query45 = cursor.executemany("SELECT * FROM table WHERE var = %s" % var, [])
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:85:26
   |
83 | query42 = cursor.execute("SELECT * FROM table WHERE var = %s" % var)
84 | query43 = cursor.execute(f"SELECT * FROM table WHERE var = {var}")
85 | query44 = cursor.execute("SELECT * FROM table WHERE var = {}".format(var))
   |                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
86 | query45 = cursor.executemany("SELECT * FROM table WHERE var = %s" % var, [])
   |

S608 Possible SQL injection vector through string-based query construction
  --> S608.py:86:30
   |
84 | query43 = cursor.execute(f"SELECT * FROM table WHERE var = {var}")
85 | query44 = cursor.execute("SELECT * FROM table WHERE var = {}".format(var))
86 | query45 = cursor.executemany("SELECT * FROM table WHERE var = %s" % var, [])
   |                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
87 |
88 | # # pass
   |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:98:11
    |
 97 | # # INSERT without INTO (e.g. MySQL and derivatives)
 98 | query46 = "INSERT table VALUES (%s)" % (var,)
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 99 |
100 | # # REPLACE (e.g. MySQL and derivatives, SQLite)
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:101:11
    |
100 | # # REPLACE (e.g. MySQL and derivatives, SQLite)
101 | query47 = "REPLACE INTO table VALUES (%s)" % (var,)
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
102 | query48 = "REPLACE table VALUES (%s)" % (var,)
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:102:11
    |
100 | # # REPLACE (e.g. MySQL and derivatives, SQLite)
101 | query47 = "REPLACE INTO table VALUES (%s)" % (var,)
102 | query48 = "REPLACE table VALUES (%s)" % (var,)
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
103 |
104 | query49 = "Deselect something that is not SQL even though it has a ' from ' somewhere in %s." % "there"
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:111:1
    |
110 | # # errors
111 | "SELECT * FROM " + ("table1" if x > 0 else "table2") # query50
    | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
112 | "SELECT * FROM " + ("table1" if x > 0 else ["table2"]) # query51
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:112:1
    |
110 | # # errors
111 | "SELECT * FROM " + ("table1" if x > 0 else "table2") # query50
112 | "SELECT * FROM " + ("table1" if x > 0 else ["table2"]) # query51
    | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
113 |
114 | # test cases from #12044
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:117:12
    |
116 |   def query52():
117 |       return f"""
    |  ____________^
118 | | SELECT {var}
119 | |     FROM bar
120 | |     """
    | |_______^
121 |
122 |   def query53():
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:123:12
    |
122 |   def query53():
123 |       return f"""
    |  ____________^
124 | |     SELECT
125 | |         {var}
126 | |     FROM bar
127 | |     """
    | |_______^
128 |
129 |   def query54():
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:130:12
    |
129 |   def query54():
130 |       return f"""
    |  ____________^
131 | |     SELECT {var}
132 | |     FROM
133 | |         bar
134 | |     """
    | |_______^
135 |
136 |   query55 = f"""SELECT * FROM
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:136:11
    |
134 |       """
135 |
136 |   query55 = f"""SELECT * FROM
    |  ___________^
137 | | {var}.table
138 | | """
    | |___^
139 |
140 |   query56 = f"""SELECT *
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:140:11
    |
138 |   """
139 |
140 |   query56 = f"""SELECT *
    |  ___________^
141 | | FROM {var}.table
142 | | """
    | |___^
143 |
144 |   query57 = f"""
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:144:11
    |
142 |   """
143 |
144 |   query57 = f"""
    |  ___________^
145 | | SELECT *
146 | | FROM {var}.table
147 | | """
    | |___^
148 |
149 |   query57 = f"""
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:160:11
    |
159 |   # https://github.com/astral-sh/ruff/issues/15653
160 |   query59 = f"""
    |  ___________^
161 | |     SELECT *, foo
162 | |     FROM ({user_input}) raw
163 | | """
    | |___^
164 |   query60 = f"""
165 |       SELECT *,
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:164:11
    |
162 |       FROM ({user_input}) raw
163 |   """
164 |   query60 = f"""
    |  ___________^
165 | |     SELECT *,
166 | |         foo
167 | |     FROM ({user_input}) raw
168 | | """
    | |___^
169 |
170 |   # https://github.com/astral-sh/ruff/issues/17967
    |

S608 Possible SQL injection vector through string-based query construction
   --> S608.py:180:11
    |
178 |     FROM ({user_input}) raw
179 | """
180 | query64 = f"update {t"{table}"} set var = {t"{var}"}"
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
181 | query65 = t"update {f"{table}"} set var = {f"{var}"}"
    |
