On Thu, Jun 27, 2002 at 11:54:18AM -0700, Steve Freitas wrote:
> The htmlEncode() method, as I recently discovered thanks to Ian, is good to
> use to prevent malicious inputs from being undesirably reproduced in web
> pages. Storing inputs in a SQL database presents the same kind of challenge,
> especially because SQL injection attacks are such nasty things.
>
> Do y'all feel that using htmlEncode() on incoming data to be included in a
> SQL query is an effective solution to that problem?
For MySQL:
s = MySQLdb.encode(s) # String.
or easier:
sql = "SELECT a, b FROM c WHERE d = %(d_value)s AND e = %(e_value)s"
dic = {'d_value': ..., 'e_value': ...}
c.execute(sql, dic) # Cursor object.
I haven't used pgdb (Postgres) much, but it seems to do the second thing
too. You may have to do a bit more quoting (e.g., around the
placeholders in the query string).
--
-Mike (Iron) Orr, [EMAIL PROTECTED] (if mail problems: [EMAIL PROTECTED])
http://iron.cx/ English * Esperanto * Russkiy * Deutsch * Espan~ol
-------------------------------------------------------
Sponsored by:
ThinkGeek at http://www.ThinkGeek.com/
_______________________________________________
Webware-discuss mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/webware-discuss
