dotty/ToDo — comment on commit 320408c689fbee4d43d80a03740944e7da054aff
File: database.c line 44
By chergert:

Use g_strdup_printf() instead of malloc+sprintf (never use sprintf). But even so, this is a SQL injection.

Use sqlite3_prepare_v2() and sqlite3_bind_text().