Daily security quiz #1

Question for 2026-11-01. Read the code and pick the most serious security vulnerability.

This login code looks up a member by ID (PostgreSQL, psycopg). What is the most serious vulnerability?

1def find_user(conn, username):
2    cur = conn.cursor()
3    query = f"SELECT id, password_hash FROM users WHERE username = '{username}'"
4    cur.execute(query)
5    return cur.fetchone()

1. AConcatenating user input into the SQL string allows SQL injection
2. BNot closing cursor causes memory usage to keep growing
3. Cfetchall() should be used instead of fetchone()
4. DRetrieving the password hash exposes it