SQL injection vulnerability in stored procedure due to unsanitized user input in string concatenation. Malicious input can lead to data loss or unauthorized access.

SQL_COPT_SS_ACCESS_TOKEN is specific to msodbcsql (documentation here) but unfortunately there's no obvious way for me to set this property with pypyodbc, since the ODBC API is hidden and attrs_before ...