Re: [SQLObject] Security / SQL Injection select with string

2007-03-18 Thread Oleg Broytmann
On Sun, Mar 18, 2007 at 09:39:30AM +0100, Gregor Horvath wrote: > This seems to work: > > >>> Tour.select("tour.id = 2; delete from tour").count() > > After that, table tour is empty. > Is there any patch or fix for that available? There is no, and I am sure it'd be hard to make one. To fix

Re: [SQLObject] Security / SQL Injection select with string

2007-03-18 Thread Simon Cross
On 3/18/07, Gregor Horvath <[EMAIL PROTECTED]> wrote: > This seems to work: > > >>> Tour.select("tour.id = 2; delete from tour").count() > > After that, table tour is empty. > Is there any patch or fix for that available? > > I think a select should only execute select sql's. In principle you're

[SQLObject] Security / SQL Injection select with string

2007-03-18 Thread Gregor Horvath
Hi, This seems to work: >>> Tour.select("tour.id = 2; delete from tour").count() After that, table tour is empty. Is there any patch or fix for that available? I think a select should only execute select sql's. Greg -