Patched code sample

import mysql.connector

def connect_to_database(host, user, password, database):
    # SECURE: This version prevents sql injection
    try:
        mydb = mysql.connector.connect(
            host=host,
            user=user,
            password=password,
            database=database
        )
        return mydb
    except mysql.connector.Error as err:
        print(f"Error connecting to database: {err}")
        return None

def execute_query(mydb, query, params=None):
    if mydb is None:
        print("No database connection available.")
        return
    try:
        mycursor = mydb.cursor()
        mycursor.execute(query, params)
        mydb.commit()
        mycursor.close()
        print("Query executed successfully.")
    except mysql.connector.Error as err:
        print(f"Error executing query: {err}")
    
def code(host, user, password, database, query, params=None):
    mydb = connect_to_database(host, user, password, database)
    if mydb is not None:
        execute_query(mydb, query, params)
        mydb.close()

if __name__ == '__main__':
    host = "your_mysql_host"
    user = "your_mysql_user"
    password = "your_mysql_password"
    database = "your_mysql_database"

    input_query = "DROP TABLE users;" 
    print("Executing malicious query: " + input_query)
    code(host, user, password, database, input_query)

    input_query = "SELECT * FROM products WHERE price > %s"
    price_value = 100
    print(f"Executing benign query with price greater than {price_value}")
    code(host, user, password, database, input_query, (price_value,))