sql statement not safe

[mikelty]

i know this is just a mockup but for the record line 131 flaskapp.py there's this line:
sql = "SELECT * FROM harshit_aws WHERE box_no = %s ORDER BY id desc limit 1"
which is very vulnerable to injection attacks. use prepared statements or templates like django i think.