Patched sqli/dao/student.py

Author: patched.codes[bot]

sqli/dao/student.py

@@ -40,8 +40,9 @@ async def get_many(conn: Connection, limit: Optional[int] = None,
     @staticmethod
     async def create(conn: Connection, name: str):
         q = ("INSERT INTO students (name) "
-             "VALUES ('%(name)s')" % {'name': name})
+             "VALUES (%s)")
         async with conn.cursor() as cur:
-            await cur.execute(q)
+            await cur.execute(q, (name,))
+