Issue in labeling the correct place of the alert in sql injection queries

Hello,

I would like to report an issue in sql injection queries, where LGTM seems to fail to report the correct location of the error in the codeline.
The following project [jamalmfarhat/lgtm-sql-injection-issue](https://lgtm.com/projects/g/jamalmfarhat/lgtm-sql-injection-issue/?mode=list) was created to replicate the problem.
In the example shown there, our security expert thinks that LGTM should label "Step 4" as the correct location of the alert.
Can you please check?