Is it possible SQL injection in flask-sqlalchemy?

Question

I have the code below in flask using SQLAlchemy and marshmallow:

def search(category_name, version):
    library = Library.query.filter(Library.category == category_name).filter(Library.subversion == version).all()

    library_schema = LibrarySchema(many=True)
    data = library_schema.dump(library)
    return data

How can I be sure the code is not vulnerable to SQL injection?

Answer 1

The quickest way to be check if you're vulnerable is to send "X' OR '1' = '1'--" as category_name / version to that function and see what happens.

In other words, perform the sql injection yourself.