Re: Wierd "ProgrammingError" with "E" string prefix
Federico Di Gregorio <fog-NGVKUo/i/[email protected]>
| Newsgroups | gmane.comp.python.db.psycopg.devel |
|---|---|
| Organization | initd.org |
| Message-ID | <[email protected]> |
Il giorno mer, 04/03/2009 alle 09.41 +0100, Harald Armin Massa ha
scritto:
> Tim,
>
>
> >> cur.execute("DROP TABLE %s", (table_name,))
> > Don't let psycopg do the quoting for table and field names. The
> > automatic quoting is ONLY appropriate for field values. Just use the
> > normal % operator:
> > cur.execute("DROP TABLE %s" % table_name )
>
> obviously this is the correct solution.
>
> BUUUTTTT.... we all learned from xkcd (little droppi table) that using
> string substitution to create SQL is a visit to the dark side.
> So, my question: is there any sql-injection save way to dynamically
> insert table-names into a SQL?
Not right now. We can probably add a wrapper that is quoted by psycopg
according to PostgreSQL rules for indentifiers. I never needed that
because I never needed to use untrusted data to operate on the database
schema, so patches are welcome.
Something like:
curs.execute("DROP TABLE %s", (Identifier(unstrusted_data),))
federico
--
Federico Di Gregorio http://people.initd.org/fog
Debian GNU/Linux Developer [email protected]
INIT.D Developer fog-NGVKUo/i/[email protected]
- Ma cos'ha il tuo pesce rosso, l'orchite?
- Si, ha un occhio solo, la voce roca e mangia gli altri pesci.
_______________________________________________
Psycopg mailing list
Psycopg-IAPFreCvJWPBWskQ1e/[email protected]
http://lists.initd.org/mailman/listinfo/psycopg
signature.asc
(application/pgp-signature, 197 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEABECAAYFAkmuQvYACgkQvcCgrgZGjeseMwCdHpJ2HL1xXzKwA0on57jZafWE P20AoKucnrCXaxn3R+RyCu3u66lj66m4 =QGii -----END PGP SIGNATURE-----