On Fri, Jul 16, 2010 at 10:09 AM, MRAB <pyt...@mrabarnett.plus.com> wrote:
> Victor Subervi wrote:
>
>> Hi;
>> I have the following code:
>>
>> cursor.execute('select MyTable from optionsDetails where Store=%s',
>> (store,))
>> options_tables = [item[0] for item in cursor]
>> for table in options_tables:
>> cursor.execute('select * from %' % table)
>>
>> Should be:
>
> 'select * from %s' % table
>
> Details! :-)
LOL. Whoops. Thanks.
>
>
> You can already see what my question is. One of y'all said it's possible
>> under certain conditions to use the % without risking attack. Now is when I
>> need to know how to do that. Please advise.
>>
>> It's safe when there's no way that the value you're putting in can come
> from the user.
>
> Here you're taking it from the 'optionsDetails' table. Can the user add,
> alter or delete that entry in any way?
>
No, and that's kind of what I figured. Thanks!
beno
--
http://mail.python.org/mailman/listinfo/python-list
