autoreview_demo.py

@@ -0,0 +1,6 @@
+def divide(a, b):
+    return a / b  # no zero-division guard
+
+def run_query(name):
+    # SQL injection: unsanitized string interpolation
+    return "SELECT * FROM users WHERE name = '" + name + "'"