Re: Wierd "ProgrammingError" with "E" string prefix

Il giorno mer, 04/03/2009 alle 06.30 -0800, Adrian Klaver ha scritto:
> On Wednesday 04 March 2009 12:59:34 am Federico Di Gregorio wrote:
> > Il giorno mer, 04/03/2009 alle 09.41 +0100, Harald Armin Massa ha
> >
> > scritto:
> > > Tim,
> > >
> > > >> cur.execute("DROP TABLE %s", (table_name,))
> > > >
> > > > Don't let psycopg do the quoting for table and field names.  The
> > > > automatic quoting is ONLY appropriate for field values.  Just use the
> > > > normal % operator:
> > > >    cur.execute("DROP TABLE %s"  %  table_name )
> > >
> > > obviously this is the correct solution.
> > >
> > > BUUUTTTT.... we all learned from xkcd (little droppi table) that using
> > > string substitution to create SQL is a visit to the dark side.
> > > So, my question: is there any sql-injection save way to dynamically
> > > insert table-names into a SQL?
> >
> > Not right now. We can probably add a wrapper that is quoted by psycopg
> > according to PostgreSQL rules for indentifiers. I never needed that
> > because I never needed to use untrusted data to operate on the database
> > schema, so patches are welcome.
> >
> > Something like:
> >
> > curs.execute("DROP TABLE %s", (Identifier(unstrusted_data),))
> >
> > federico
> 
> Might want to take a look at dbapiext which already does this :)
> 
> http://furius.ca/pubcode/pub/antiorm/lib/python/dbapiext.py.html

This is something I DON'T want to use. Why? Try this using a real table
in your database (and using execute() instead of apply()):

q = dbapiext.qcompile('SELECT foo FROM %(table)s')
print q.apply(table="bar;DROP TABLE foo;")

-- 
Federico Di Gregorio                         http://people.initd.org/fog
Debian GNU/Linux Developer                                [email protected]
INIT.D Developer                                           fog-NGVKUo/i/[email protected]
              All programmers are optimists. -- Frederick P. Brooks, Jr.

_______________________________________________
Psycopg mailing list
Psycopg-IAPFreCvJWPBWskQ1e/[email protected]
http://lists.initd.org/mailman/listinfo/psycopg

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEABECAAYFAkmulWsACgkQvcCgrgZGjesY+QCfXNloC/UsNjYYaSh8j6V3/+bP
v4UAnRkefSLAmCwSQbXcCSjSOgRC5+4Z
=sZ/N
-----END PGP SIGNATURE-----