PyPGSQL uses the same parameter quoting as MySQLdb, and you can also import a PGQuote
function that works.
-Aaron
----- Original Message -----
From: "Mike Orr" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 27, 2002 3:49 PM
Subject: Re: [Webware-discuss] htmlEncode good for SQL?
> On Thu, Jun 27, 2002 at 11:54:18AM -0700, Steve Freitas wrote:
> > The htmlEncode() method, as I recently discovered thanks to Ian, is good to
> > use to prevent malicious inputs from being undesirably reproduced in web
> > pages. Storing inputs in a SQL database presents the same kind of challenge,
> > especially because SQL injection attacks are such nasty things.
> >
> > Do y'all feel that using htmlEncode() on incoming data to be included in a
> > SQL query is an effective solution to that problem?
>
> For MySQL:
> s = MySQLdb.encode(s) # String.
> or easier:
> sql = "SELECT a, b FROM c WHERE d = %(d_value)s AND e = %(e_value)s"
> dic = {'d_value': ..., 'e_value': ...}
> c.execute(sql, dic) # Cursor object.
>
> I haven't used pgdb (Postgres) much, but it seems to do the second thing
> too. You may have to do a bit more quoting (e.g., around the
> placeholders in the query string).
>
> --
> -Mike (Iron) Orr, [EMAIL PROTECTED] (if mail problems: [EMAIL PROTECTED])
> http://iron.cx/ English * Esperanto * Russkiy * Deutsch * Espan~ol
>
>
> -------------------------------------------------------
> Sponsored by:
> ThinkGeek at http://www.ThinkGeek.com/
> _______________________________________________
> Webware-discuss mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/webware-discuss
>
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Bringing you mounds of caffeinated joy.
http://thinkgeek.com/sf
_______________________________________________
Webware-discuss mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/webware-discuss
