# VULNERABLE
query = f"SELECT ... WHERE username = '{username}' ..."
cur.execute(query)
# SECURE
query = "SELECT ... WHERE username = ? AND password = ?"
cur.execute(query, (username, password))
Rule of thumb: If you ever find yourself using f-strings or string concatenation to build SQL with user input, stop and use parameterized queries instead.