Re: Wierd "ProgrammingError" with "E" string prefix

On Wednesday 04 March 2009 12:59:34 am Federico Di Gregorio wrote:
> Il giorno mer, 04/03/2009 alle 09.41 +0100, Harald Armin Massa ha
>
> scritto:
> > Tim,
> >
> > >> cur.execute("DROP TABLE %s", (table_name,))
> > >
> > > Don't let psycopg do the quoting for table and field names.  The
> > > automatic quoting is ONLY appropriate for field values.  Just use the
> > > normal % operator:
> > >    cur.execute("DROP TABLE %s"  %  table_name )
> >
> > obviously this is the correct solution.
> >
> > BUUUTTTT.... we all learned from xkcd (little droppi table) that using
> > string substitution to create SQL is a visit to the dark side.
> > So, my question: is there any sql-injection save way to dynamically
> > insert table-names into a SQL?
>
> Not right now. We can probably add a wrapper that is quoted by psycopg
> according to PostgreSQL rules for indentifiers. I never needed that
> because I never needed to use untrusted data to operate on the database
> schema, so patches are welcome.
>
> Something like:
>
> curs.execute("DROP TABLE %s", (Identifier(unstrusted_data),))
>
> federico

Might want to take a look at dbapiext which already does this :)

http://furius.ca/pubcode/pub/antiorm/lib/python/dbapiext.py.html

It is part of the antiorm module
http://furius.ca/antiorm/


-- 
Adrian Klaver
[email protected]