title: Detect SQL injections in the source code
body: <p>Consider the following code snippet:</p>
  
  <pre><code>import MySQLdb
  
  def get_data(id):
      db = MySQLdb.connect(db='TEST')
      cursor = db.cursor()
      cursor.execute("SELECT * FROM TEST WHERE ID = '%s'" % id)
  
      return cursor.fetchall()
  
  print(get_data(1))
  </code></pre>
  
  <p>There is a major problem in the code - it is <em>vulnerable to SQL injections attacks</em> since the query is not parameterized through DB API and is constructed via string formatting. If you call the function this way:</p>
  
  <pre><code>get_data("'; DROP TABLE TEST -- ")
  </code></pre>
  
  <p>the following query would be executed:</p>
  
  <pre><code>SELECT * FROM TEST WHERE ID = ''; DROP TABLE TEST --  
  </code></pre>
  
  <p>Now, my goal is to analyze the code in the project and detect all places potentially vulnerable to SQL injections. In other words, where the query is constructed via string formatting as opposed to passing query parameters in a separate argument. </p>
  
  <p>Is it something that can be solved statically, with the help of <code>pylint</code>, <code>pyflakes</code> or any other static code analysis packages?</p>
  
  <hr>
  
  <p>I'm aware of <a href="https://github.com/sqlmapproject/sqlmap" rel="noreferrer"><code>sqlmap</code></a> popular penetration testing tool, but, as far as I understand, it is working against a web resource, testing it as a black-box through HTTP requests.</p>