I’m a computer science student and I’m currently learning about writing secure code.
I came across a very simple function to sanitize the input:

import re

def my_sanitize(input_string):
    sanitized_string = re.sub(r"(s+|;|<|>|')", '', input_string)
    return sanitized_string

def generate_query(username):
    sanitized_username = sanitize_input(username)
    query = 'SELECT u.`username`, g.`name` FROM user usr join identity_group grp on u.id_group = g.id_group where u.status = '5' and u.username = '%s';' %(my_sanitize(user))
    return query

input_username = "Tom1985" #is this injectable?
generated_query = generate_query(input_username)
print(f"Generated SQL Query: {generated_query}")

I know that one of the main issues that makes code vulnerable to SQL injection is the use of direct string concatenation to construct SQL queries, rather than using parameterized queries, but in reality in this specific case I wasn’t able to get any injections through.

For simple queries like in this case, does such a simple check guarantee security? I’m really curious if a technique could bypass this specific check

I expected that despite the bad practice in directly concatenating strings to build SQL queries and very basic control, it would be easier to execute a sleep(10) along with the query.