Geek asks and answers

SQL Injection Prevention in Python - is it enough to use a parameterized query?

I have the following python code:

row = conn.execute('''SELECT admin FROM account WHERE password = ?''',
(request.headers.get('X-Admin-Pass'),)).fetchone()

My question is: is this code safe for SQL injection? Since I am using a parameterized query, it should be. However, since I am passing user information directly from the header, I am a little worried :)

Any thoughts on the issue?

+3
source share
2 answers

The way you insert data into the database ensures that the SQL attack will not work, the execute method will automatically delete the parameters that you passed as a tuple as the second query parameter.

You are doing it right.

+2
source

DBI, . SQL-, SQL-.

+1

More articles:


All Articles