Chapter 2.3: SQL Injection - fix

[nxvl]

Fix part 2

In order to fix the SQL injetion once and for all, we should rely on prepared statements, and let the DB engine do the param sanitization, like this:

        sql = "INSERT INTO listings (title, description) VALUES (%s, %s)"
        cur.execute(sql, (title, description))

Now both our unit test and bandit are happy!