# Test fixture for rule `python-sqli-string-concat` (run: semgrep --test).
# Lines marked `# ruleid:` MUST fire; lines marked `# ok:` MUST NOT.
import sqlite3

cur = sqlite3.connect(":memory:").cursor()
user = input()

# ruleid: python-sqli-string-concat
cur.execute("SELECT * FROM t WHERE a = '%s'" % user)

# ruleid: python-sqli-string-concat
cur.execute("SELECT * FROM t WHERE a = '" + user)

# ruleid: python-sqli-string-concat
cur.execute(f"SELECT * FROM t WHERE a = '{user}'")

# ok: python-sqli-string-concat
cur.execute("SELECT * FROM t WHERE a = ?", (user,))

# ok: python-sqli-string-concat
cur.execute("SELECT * FROM t WHERE a = 1")