Re: Wierd "ProgrammingError" with "E" string prefix

On Wed, Mar 04, 2009 at 09:59:34AM +0100, Federico Di Gregorio wrote:

> > BUUUTTTT.... we all learned from xkcd (little droppi table) that using
> > string substitution to create SQL is a visit to the dark side.
> > So, my question: is there any sql-injection save way to dynamically
> > insert table-names into a SQL?
> 
> Not right now. We can probably add a wrapper that is quoted by psycopg
> according to PostgreSQL rules for indentifiers. I never needed that
> because I never needed to use untrusted data to operate on the database
> schema, so patches are welcome.
> 
> Something like:
> 
> curs.execute("DROP TABLE %s", (Identifier(unstrusted_data),))

Should this, then, translate to

	drop table quote_ident(untrusted_data);

or am I on the wrong track ?

Karsten
-- 
GPG key ID E4071346 @ wwwkeys.pgp.net
E167 67FD A291 2BEA 73BD  4537 78B9 A9F9 E407 1346