How do you prevent SQL injection in Flask apps?

Summary

Use SQLAlchemy's query building or bound parameters (text('... WHERE id = :id') with params) and never build SQL with f-strings from user input; allow-list identifiers like sort columns.

Longer Answer

ORMs parameterize values automatically, but raw text() with string interpolation reintroduces risk. Validate and map user-chosen sort fields to known columns.

Key Points

• ORM / bound parameters
• No f-string SQL
• Allow-list identifiers