# Pattern 1: Parameterized query (SQLAlchemy)
# ❌ Bad: f"SELECT * FROM users WHERE id = {user_id}"
# ✅ Good:
result = await db.execute(
    select(User).where(User.id == user_id)
)

# Pattern 2: Input validation (FastAPI)
from pydantic import validator

class UserInput(BaseModel):
    username: str
    
    @validator('username')
    def validate_username(cls, v):
        if not v.isalnum():
            raise ValueError('Alphanumeric only')
        return v

# Pattern 3: Secure subprocess
import subprocess
# ❌ Bad: subprocess.run(f"ping {host}", shell=True)
# ✅ Good:
subprocess.run(["ping", "-c", "1", host], shell=False)

# Pattern 4: Path traversal prevention
from pathlib import Path

def safe_path(base_dir: str, user_path: str) -> Path:
    base = Path(base_dir).resolve()
    target = (base / user_path).resolve()
    if not str(target).startswith(str(base)):
        raise ValueError("Path traversal detected")
    return target