Re: Wierd "ProgrammingError" with "E" string prefix

Harald Armin Massa wrote:
> obviously this is the correct solution.
>
> BUUUTTTT.... we all learned from xkcd (little droppi table) that using
> string substitution to create SQL is a visit to the dark side.
> So, my question: is there any sql-injection save way to dynamically
> insert table-names into a SQL?
>
> as in "select col1, col2, col3 from %(table)s where ..."
>
> to make sure nobody inserts "correcttab; drop table students;" as name
> for %(table)s ??
>   

You've already had a good exchange on this, but it's worth pointing out
that it is quite rare for a web application to take table and field
names directly from user input.  When you're responding to a form,
you're getting field VALUES from the form, but the field and table NAMES
are typically fixed.

Of course, there are exceptions.  General-purpose applications like
phpMyAdmin and pgAdmin certainly have to worry about this kind of thing.

-- 
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.