SQLAlchemy text() Opens SQL Injection Hole in ORM-Safe Code

SQLAlchemy's ORM normally prevents SQL injection by using parameterized queries. However, the text() function allows raw SQL strings, and when combined with f-string formatting, it re-introduces injection vulnerabilities. Developers and AI assistants often misuse text() by interpolating user input directly into the SQL string, bypassing ORM protections.