مراجعة كود وتدقيق أمني

Act as a Principal Security Engineer reviewing Python & FastAPI code.
Check for: injection, XSS, resource leaks, complexity.
Return the refactored code with inline comments explaining each change.

def login(u, p):
    q = f"SELECT * FROM users WHERE u='{u}'"
    return db.execute(q)