Re: [pysqlite] [APSW] "SQLError: cannot rollback - no transaction is active"

Dennis Lee Bieber wrote:

>> 		value = m.group(1).strip()
>> 		sql = 'UPDATE membres SET %s="%s" WHERE id=%s' % (name,value,id)
> 
> 	DON'T supply your data value in such a manner! It is unsafe --
> ignoring potential injection attacks, if /value/ contains a " you will
> have invalid SQL.

this is a problem I've wrestled with on more than one occasion.  I tend to use
string substitution when I have a case where I'm generating some SQL because I
have varying conditions which require very different SQL expressions.  For
example, I have one case where I have to generate a select statement based on
four fields.  if I needed to enumerate them, I would have to deal with six
different select statements each with different arguments.  Not fun.  But with
string substitution, I now have a very small amount of code in four logical
blocks making it easy for me to visually inspect the code and unit test the code.

all I can say is both approaches have unpleasant consequences.


---eric