On Oct 22 02:33, Uwe C. Schroeder wrote: > On Sunday 22 October 2006 12:32, Volkan YAZICI wrote: > > If I were you, I'd ask psycopg2 developers to implement parameters that > > are natively supported by PostgreSQL. With parameters, you won't mess up > > with any escaping or injection related issue. > > psycopg2 supports parameters which are escaped properly.
You're wrong. psycopg uses Python style parameters and escapes the specified input before inserting into query string. See documentation of PQexecParams() for the "parameters" I mentioned. I think, you're confusing terms. I just checked psycopg2 source code and couldn't see any parameter implementation. Regards. ---------------------------(end of broadcast)--------------------------- TIP 2: Don't 'kill -9' the postmaster
