add hint

Author: righettod

docs/8-CODEREVIEW_UTILS.md

@@ -185,6 +185,29 @@ for value in ["", " "]:
         print("FALSE")
 ```
 
+* For the module `logging`, there is a difference between the `%s` and `%r` in the log message template:
+  * `%s` uses `str(obj)` ([documentation](https://docs.python.org/3/library/stdtypes.html#str)).
+  * `%r` uses `repr(obj)` ([documentation](https://docs.python.org/3/library/functions.html#repr)) .
+  * When applied against a **string** value:
+    * `%s` renders the string as-is.
+    * `%r` shows escape characters and quotes, making **invisible characters visible**.
+  * Therefore `%r` is privilegied to prevent exposure to log forging when a string value need to be logged.
+
+```python
+import logging
+logging.basicConfig(level=logging.INFO)
+text = "My\n\rlong\tString"
+logging.info("===> Using %%s: %s", text)
+logging.info("===> Using %%r: %r", text)
+```
+
+```bash
+# Result of the execution of the code above
+INFO:root:===> Using %s: My
+long    String
+INFO:root:===> Using %r: 'My\n\rlong\tString'
+```
+
 ## Automated review using SemGrep
 
 > 💡 This [dedicated toolbox](https://github.com/righettod/toolbox-codescan) can be used.