SQL Injection via string concatenation

def search_users(conn):
    term = request.args.get("q", "")
    query = "SELECT * FROM users WHERE email LIKE '%" + term + "%'"
    return conn.execute(query).fetchall()