From 3282035568dc83e2d616b097aa8c1695e160f772 Mon Sep 17 00:00:00 2001
From: limuthu123 <168603554+limuthu123@users.noreply.github.com>
Date: Sun, 31 May 2026 01:37:16 +0530
Subject: [PATCH] fix(db): use parameterized queries to prevent SQL injection
 in getJailNames

---
 fail2ban/server/database.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban/server/database.py b/fail2ban/server/database.py
index 4eba7848..8364b12d 100644
--- a/fail2ban/server/database.py
+++ b/fail2ban/server/database.py
@@ -443,7 +443,7 @@ class Fail2BanDb(object):
 		if enabled is None:
 			cur.execute("SELECT name FROM jails")
 		else:
-			cur.execute("SELECT name FROM jails WHERE enabled=%s" %
+			cur.execute("SELECT name FROM jails WHERE enabled=?",
 				(int(enabled),))
 		return set(row[0] for row in cur.fetchmany())