title: Python SQLite3 SQL Injection Vulnerable Code
body: <p>I know that the code snippets below are vulnerable to SQL Injection because of the .format, but i do not know why. Does anyone understand why this code is vulnerable and where i would start to fix it? I am aware that these code snippets leave the input fields open to execute other malicious commands via SQL Injection but don't know why</p>
  
  <pre><code>cursor.execute("insert into user(username, password)"
           "  values('{0}', '{1}')".format(username, password))
  
  handle[0].execute("insert into auditlog(userid, event)"
                    "  values({0}, ‘{1}')".format(handle[2],event))
  
  audit((cursor, connection, 0), 
      "registeration error for {0}”.format(username))
  
   sql="""insert into activitylog(userid, activity, start, stop)
             values({0}, '{1}', '{2}', '{3}')
        """.format(handle[2], activity, start, stop)
  </code></pre>