SQLAlchemy + SQL Injection
tldr: Avoid raw SQL as much as possible. The accepted answer is lazy and incorrect. The filter method accepts raw SQL, and if used in that way, is fully susceptible to SQL injection attacks. For instance, if you were to accept a value from a url and combine it with raw sql in the filter, … Read more