fix: parameterize SQL queries in the db layer

Author: TrueFurina

spiderfoot/db.py

@@ -1536,8 +1536,8 @@ def scanElementSourcesDirect(self, instanceId: str, elementIdList: list) -> list
             tbl_event_types st \
             WHERE c.scan_instance_id = ? AND c.source_event_hash = s.hash AND \
             s.scan_instance_id = c.scan_instance_id AND st.event = s.type AND \
-            t.event = c.type AND c.hash in ('%s')" % "','".join(hashIds)
-        qvars = [instanceId]
+            t.event = c.type AND c.hash in (%s)" % ",".join("?" * len(hashIds))
+        qvars = [instanceId] + hashIds
 
         with self.dbhLock:
             try:
@@ -1585,8 +1585,8 @@ def scanElementChildrenDirect(self, instanceId: str, elementIdList: list) -> lis
             FROM tbl_scan_results c, tbl_scan_results s, tbl_event_types t \
             WHERE c.scan_instance_id = ? AND c.source_event_hash = s.hash AND \
             s.scan_instance_id = c.scan_instance_id AND \
-            t.event = c.type AND s.hash in ('%s')" % "','".join(hashIds)
-        qvars = [instanceId]
+            t.event = c.type AND s.hash in (%s)" % ",".join("?" * len(hashIds))
+        qvars = [instanceId] + hashIds
 
         with self.dbhLock:
             try: