Language: Python
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    def write_log(self, log_message, ipaddress):
        # Make entry.
        db = self.connect_logdb()
        c = db.cursor()

        # Insert a row of data.
        c.execute(
            f"""insert into log
                values ({datetime.utcnow().strftime('%Y%m%d')}, {datetime.utcnow().strftime('%H%M%S')}, ?, ?)""",
            log_message,
            ipaddress,
        )

        # Save (commit) the changes.
        db.commit()

        # Close cursor.
        c.close()

        # Close connection.
        db.close()