[Python] Improper neutralization of special elements used in an SQL Command ('SQL Injection')

I am working on a project and want to delete the table by passing the table_name which is coming from an API request. I want to bypass SQL Injection warning for delete query.

I am using Python, and SSMS. Help me to pass my warning.

def truncate_and_load_data_to_tpp(df: pd.DataFrame, date: str, table_name: str, logger: logging.Logger, vendor: str = None):
allowed_tables = []
if table_name not in allowed_tables:
allowed_tables.append(table_name)

conn_tpp = create_connection("tpp")
try:
if table_name in allowed_tables:
with conn_tpp as conn:
logger.info(f"Deleting existing data from {table_name} where month = '{date}'")
cursor = conn.cursor()
if vendor:
delete_query = f"DELETE FROM {table_name} WHERE month = %s AND vendor = %s"
cursor.execute(delete_query, (date, vendor))
else:
delete_query = f"DELETE FROM {table_name} WHERE month = %s"
cursor.execute(delete_query, (date,))
conn.commit()
except Exception as e:
error_msg = f"Error deleting data from TPP for month {date}: {e}"
logger.error(error_msg)


I am getting the high vulnerability here. Help me to solve please. or tell me alternate approach.

Continue reading...