No, definitely not. The most important character to quote in a SQL
statement is ', and that isn't quoted by htmlEncode. You should use a
different quoter. Database adapters usually have some sort of quoting
built in. But here's what I use:
_sqlQuoteRE = re.compile("'")
def sqlQuote(value):
"""
Quote a value for insertion as a SQL value. Puts ' around
strings, nothing around numbers, turns None into NULL,
and turns arrays into (<quoted values>, ...)
"""
if type(value) is type(""):
return "'%s'" % _sqlQuoteRE.sub("\\'", str(value))
elif value is None:
return "NULL"
elif type(value) is type(()) or \
type(value) is type([]):
return "(" + string.join(map(sqlQuote, value), ", ") + ")"
elif type(value) is type(1) or \
type(value) is type(1L):
return "%i" % value
elif type(value) is type(1.0):
return str(value)
elif isinstance(value, SQLExpression):
return value.sqlRepr()
elif type(value) is DateTimeType:
return "'%s'" % isoStr(value)
else:
raise ValueError, "Unknown type to quote: %s for %s" % \
(type(value), repr(value))
(note, this quotes Python types and adds quotes around strings, so the
string "what's up" becomes "'what\\'s up'")
On Thu, 2002-06-27 at 13:54, Steve Freitas wrote:
> The htmlEncode() method, as I recently discovered thanks to Ian, is good to
> use to prevent malicious inputs from being undesirably reproduced in web
> pages. Storing inputs in a SQL database presents the same kind of challenge,
> especially because SQL injection attacks are such nasty things.
>
> Do y'all feel that using htmlEncode() on incoming data to be included in a
> SQL query is an effective solution to that problem?
>
> Steve
>
>
>
> -------------------------------------------------------
> Sponsored by:
> ThinkGeek at http://www.ThinkGeek.com/
> _______________________________________________
> Webware-discuss mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/webware-discuss
>
-------------------------------------------------------
Sponsored by:
ThinkGeek at http://www.ThinkGeek.com/
_______________________________________________
Webware-discuss mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/webware-discuss
