Re: Subtle Syntax Error
Christopher Arndt <[email protected]>
| Newsgroups | gmane.comp.python.db.pysqlite.user |
|---|---|
| Message-ID | <[email protected]> |
Rich Shepard schrieb:
> Thank you, Greg.
>
> It also works as
>
> self.appData.cur.execute("delete from subpolicy where subpol_name = '%s'" % gone)
>
> Now I have three ways, all correct.
No! Get in the habit of using the second form (i.e. the one with the '?' as the
placeholder)! In the code you showed, the 1st and 3rd might be ok, but if the
value of 'gone' was provided from outside of your program, i.e. from a website
form or similar, you're in trouble.
http://en.wikipedia.org/wiki/Sql_injection
Chris
_______________________________________________
pysqlite mailing list
pysqlite-IAPFreCvJWPBWskQ1e/[email protected]
http://lists.initd.org/mailman/listinfo/pysqlite
chris.vcf
(text/x-vcard, 417 B)
begin:vcard fn:Christopher Arndt n:Arndt;Christopher adr;quoted-printable;quoted-printable:;;Glasstra=C3=9Fe 58;K=C3=B6ln;Nordrhein-Westfalen;50823;Germany email;internet:[email protected] title:Anwendungsentwicklung & Linux-Consulting tel;work:+49 (0)221-7883972 tel;fax:+49 (0)221-7881421 tel;cell:+49 (0)176-28259175 x-mozilla-html:FALSE url:http://chrisarndt.de version:2.1 end:vcard