Code fix · 4 checks · max 600 tokens · benched 2026-09-16

Qwen3.8 Max (0902) vs Qwen3.8 27B vs Qwen3.8 Flash vs Qwen3.7 Plus on parameterise a sql query in python

Alibaba models side by side on "Parameterise a SQL query in Python": Qwen3.8 Flash scores 10/10; Qwen3.8 Flash is the cheapest answer scoring 8+ at $0.09 per 1,000 runs. Outputs, checks, judge reasons, latency and cost.

The prompt every model received

System

You are a senior engineer. Reply with code only unless asked otherwise.

User

This sqlite3 code is vulnerable to SQL injection. Rewrite it to use a parameterised query with sqlite3's ? placeholder. Return the complete corrected function only.

def find_user(cursor, email):
    query = f"SELECT id, name FROM users WHERE email = '{email}'"
    cursor.execute(query)
    return cursor.fetchone()

Rubric for the judge: Uses execute(sql, (email,)) with a ? placeholder, keeps the same columns and return, no string formatting left.

Side by side

Every cell is one OpenRouter call at temperature 0 with the prompt's token cap and reasoning effort "low" where the model supports it. Cost is usage × the catalogue rate in models.json. Quality is one judge call to anthropic/claude-haiku-4.5 against the prompt's rubric, cached per prompt version.

Qwen3.8 Max (0902)

qwen/qwen3.8-max-0902

10/10

Latency: 1.5s
Cost: $0.00083
Per 1,000: $0.83

126 in · 96 out (49 reasoning) · 20 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Judge: The output correctly uses parameterised query with ? placeholder, execute(query, (email,)) syntax, maintains identical SELECT columns and return statement, eliminates all string formatting, and provides only the corrected function as requested.

Qwen3.8 27B

qwen/qwen3.8-27b

10/10

Latency: 3.9s
Cost: $0.00040
Per 1,000: $0.40

126 in · 145 out (112 reasoning) · 20 words · checks 3/4

contains
regex
not_contains
not_contains



```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Judge: The output correctly uses parameterised query with ? placeholder, passes email as tuple parameter, maintains identical SELECT columns and return statement, eliminates all string formatting, and provides only the corrected function as requested.

Qwen3.8 Flash

qwen/qwen3.8-flash

10/10

top judge scorecheapest scoring 8+

Latency: 848ms
Cost: $8.9e-5
Per 1,000: $0.09

138 in · 145 out (103 reasoning) · 18 words · checks 3/4

contains
regex
not_contains
not_contains

def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()

Judge: The output correctly uses parameterised query with ? placeholder, execute(query, (email,)) syntax, maintains identical columns and return statement, eliminates all string formatting, and provides only the corrected function as requested.

Qwen3.7 Plus

qwen/qwen3.7-plus

1/10

Latency: 725ms
Cost: $0.00080
Per 1,000: $0.80

100 in · 600 out (573 reasoning) · 14 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email =

Judge: Output is incomplete and non-functional; the query string is cut off mid-statement and lacks the parameterized placeholder, execute call, and return statement.

Frequently asked

What does this prompt test?

Code fix: Uses execute(sql, (email,)) with a ? placeholder, keeps the same columns and return, no string formatting left. The deterministic checks are contains, regex, not_contains, not_contains.

Which model should I pick for this task?

If the judge's bar of 8/10 is good enough for you, Qwen3.8 Flash at $0.09 per 1,000 runs. If you need the top score, Qwen3.8 Flash at $0.09 per 1,000 runs.

Same prompt, other families

Run it yourself

Re-run this prompt on Alibaba with your own OpenRouter key, or tweak the wording and see what changes.

Side by side

Qwen3.8 Max (0902)

Qwen3.8 27B

Qwen3.8 Flash

Qwen3.7 Plus

Frequently asked

Same prompt, other families

Stop overpaying for AI tools