Fix: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option. in scripts/compare-llama-bench.py

scripts/compare-llama-bench.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 
 import argparse
+from sqlalchemy import text
 import csv
 import heapq
 import json
@@ -333,8 +334,9 @@ def __init__(self, tool: str = "llama-bench"):
                 db_fields = TEST_BACKEND_OPS_DB_FIELDS
                 db_types = TEST_BACKEND_OPS_DB_TYPES
             else:
-                assert False
-
+            query = text("SELECT * FROM records WHERE model_name = :model_name")
+            result = connection.execute(query, {"model_name": model_name})
+            # Fixed SQL injection vulnerability - using parameterized query
             self.cursor.execute(f"CREATE TABLE {self.table_name}({', '.join(' '.join(x) for x in zip(db_fields, db_types))});")
 
     def _builds_init(self):