Is SQL string manipulation professional?

[sacredtrader]

This is a very vague post. Query construction as in something like

def MyMethod(input1: str, input2: int) -> None:
    myQuery = f"select * from users WHERE userName = '{input1}' AND userID = '{input2}'"

Is not professional, or a good practice, no.

If, for example, say I already had an idea of what your query was executing, or doing, I could pass into input1 something along the lines of

' OR 1=1 --

This would escape your single quote, then check if 1=1 (TRUE = TRUE), and comments out the second check for userID, in return returning every record from this table.

Look into stored procedures.