Review this Flask API endpoint for security vulnerabilities. Identify ALL security issues and explain the fix for each. ```python from flask import Flask, request, jsonify import sqlite3 import pickle import os app = Flask(__name__) @app.route('/api/user/<user_id>') def get_user(user_id): conn = sqlite3.connect('users.db') cursor = conn.cursor() query = f"SELECT * FROM users WHERE id = {user_id}" cursor.execute(query) user = cursor.fetchone() return jsonify({"user": user}) @app.route('/api/upload', methods=['POST']) def upload_file(): file = request.files['file'] filename = file.filename file.save(os.path.join('/uploads', filename)) return jsonify({"status": "uploaded", "path": f"/uploads/{filename}"}) @app.route('/api/settings', methods=['POST']) def update_settings(): data = pickle.loads(request.data) # Process settings... return jsonify({"status": "updated"}) @app.route('/api/redirect') def redirect_user(): url = request.args.get('url') return f'<meta http-equiv="refresh" content="0;url={url}">' ```