Re: Re: Popularity of Quixote
Ian Bicking <[email protected]>
| Newsgroups | gmane.comp.web.quixote.user |
|---|---|
| Message-ID | <[email protected]> |
Paul Moore wrote: > On 10/27/05, Oleg Broytmann <[email protected]> wrote: > >>On Thu, Oct 27, 2005 at 11:56:20AM +0100, Paul Moore wrote: >> >>>... and you generally shouldn't paste escaped values into SQL >>>statements, but rather use bind variables in any case. >> >> Nice theory. Hard in practice. Python DB API drivers are poor at quoting >>different data types. > > > Wow! How depressing. I only use Oracle, and cx_Oracle is fine at this. > Not using bind variables is dreadful for performance on Oracle, and > allows the possibility of SQL injection attacks if you're not > extremely careful with quotings. Do other DBMSs have similar issues? > > I'd have thought that such issues count as bugs - do people raise them > as such? (I'm not criticising, I just don't know what people's > expectations are for other systems...) The drivers for the open source databases use string substitution anyway (though perhaps at the C level, for a very minor boost), so the performance difference probably isn't that substantial. -- Ian Bicking | [email protected] | http://blog.ianbicking.org