deelan <[EMAIL PROTECTED]> writes:
[...]
> query = "UPDATE blogs_news SET text = %s WHERE id=%s"
> cursor.execute(query, (text_extrated, id))
> 
> so mysqldb will take care to quote text_extrated automatically. this
> may not not your problem, but it's considered "good style" when dealing
> with dbs.
[...]

More than just good style: it prevents SQL injection attacks that
could otherwise allow people to do bad things to your databases.


John

-- 
http://mail.python.org/mailman/listinfo/python-list

Reply via email to