Re: [Tutor] SQLite, Python and SQL injection attacks

2015-08-14 Thread Cameron Simpson
On 14Aug2015 13:40, boB Stepp wrote: I was just looking at the sqlite3 docs at https://docs.python.org/3/library/sqlite3.html?highlight=sqlite#module-sqlite3 and found the following cheery news: "Usually your SQL operations will need to use values from Python variables. You shouldn’t assemble y

Re: [Tutor] SQLite, Python and SQL injection attacks

2015-08-14 Thread Emile van Sebille
On 8/14/2015 11:40 AM, boB Stepp wrote: I was just looking at the sqlite3 docs at https://docs.python.org/3/library/sqlite3.html?highlight=sqlite#module-sqlite3 and found the following cheery news: "Usually your SQL operations will need to use values from Python variables. You shouldn’t assemb

Re: [Tutor] SQLite, Python and SQL injection attacks

2015-08-14 Thread Alan Gauld
On 14/08/15 19:40, boB Stepp wrote: "Instead, use the DB-API’s parameter substitution. Put ? as a placeholder wherever you want to use a value, and then provide a tuple of values as the second argument to the cursor’s execute() method..." This is not a Sqlite issue its true of any database.

[Tutor] SQLite, Python and SQL injection attacks

2015-08-14 Thread boB Stepp
I was just looking at the sqlite3 docs at https://docs.python.org/3/library/sqlite3.html?highlight=sqlite#module-sqlite3 and found the following cheery news: "Usually your SQL operations will need to use values from Python variables. You shouldn’t assemble your query using Python’s string operat