1.5Parameterized Queries (Prevent SQL Injection)

Always use parameterized queries in test code:

# BAD: string interpolation — SQL injection vulnerability
cursor.execute(f"SELECT * FROM users WHERE email = '{email}'")

# GOOD: parameterized query — safe
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))

# GOOD: named parameters
cursor.execute(
    "SELECT * FROM users WHERE email = %(email)s AND role = %(role)s",
    {"email": email, "role": "admin"}
)

Even in test code, use parameterized queries. It is a good habit, prevents accidental injection when test data contains special characters, and makes code reviewers happy.