Re: Re: "create database" not allowed within transaction

Karsten Hilbert <[email protected]> Thu, 12 May 2005 17:54:34 +0200

Newsgroups	gmane.comp.python.db.pypgsql.user
Message-ID	<[email protected]>

>          sql ="""
>                   INSERT INTO trabajador
>                   VALUES("""+ ",".join(["'%s'" %(n1) for n1 in trabajador])+")"
>          self.cursor.execute(sql)
Don't do that.

Do

    sql = "... where ... = %s and ... = %s and ..."
    self.cursor.execute(sql, trabadajor)

Otherwise people can run SQL injection attacks unless you are
*really* careful.

Karsten
-- 
GPG key ID E4071346 @ wwwkeys.pgp.net
E167 67FD A291 2BEA 73BD  4537 78B9 A9F9 E407 1346


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click