diff --git a/ChangeLog b/ChangeLog
index 216ffe88..1e30b2e6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,6 +18,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
   to use it as before set `mode = more` for exim jail, but be aware of the consequences.
 
 ### Fixes
+* Potential SQL injection in database.py using parameterized queries
 * fixes `systemd` bug with missing journal descriptor after rotation by reopening of journal if it is recognized as not alive (gh-3929)
 * improve threaded clean-up of all filters, new thread functions `afterStop` (to force clean-up after stop) and `done`, invoking `afterStop` once
 * ensure journal-reader is always closed (additional prevention against leaks and "too many open files"), thereby avoid sporadic segfault
diff --git a/fail2ban/server/database.py b/fail2ban/server/database.py
index 4eba7848..8364b12d 100644
--- a/fail2ban/server/database.py
+++ b/fail2ban/server/database.py
@@ -443,7 +443,7 @@ class Fail2BanDb(object):
 		if enabled is None:
 			cur.execute("SELECT name FROM jails")
 		else:
-			cur.execute("SELECT name FROM jails WHERE enabled=%s" %
+			cur.execute("SELECT name FROM jails WHERE enabled=?",
 				(int(enabled),))
 		return set(row[0] for row in cur.fetchmany())