SQL injektionn

main.py

@@ -112,7 +112,7 @@ def remove_user():
 @app.route("/adduser/user", methods=['GET'])
 def adduser():
     user = request.args.get("username")
-    c.execute(f"SELECT * FROM users WHERE username='{str(user)}'") 
+    c.execute(f"SELECT * FROM users WHERE username='%users'", {'user' : user}) 
     if c.fetchall() == []:
         c.execute("INSERT or IGNORE INTO users (username, balance) VALUES ('%(user)s', 0)", {'user' : user} )
         conn.commit()