neckbeard

The described change is a blocking SQL injection vulnerability risk: an untrusted HTTP parameter (`report_name`) is interpolated directly into an SQL query string via f-string construction, with no upstream validation mentioned. The correct fix is to use parameterized queries/bound parameters and avoid building SQL by concatenating or interpolating user input into query text.