Add SQL injection check for incoming data

[jnanic]

Use marshmallow validate field to check for special characters to protect against SQL injection attacks.
Check this - marshmallow-code/marshmallow#167

[ThiefMaster]

This is a bad idea. If you need to sanitize your input for SQL injection it means your database code is broken since it doesn't use parametrized queries but rather string interpolation.

[jnanic]

Bout database code uses SQLAlchemy to add and get objects from the database and not execute raw sql strings. Under the hood SQLAlchemy auto escapes any parameter and/or special characters that would be interpreted as part of valid sql command if it were part of raw sql string. This is just to add extra layer of security on top of that.
But this was a good point. Thanks!