Re: Python or PHP?

Leif Biberg Kristensen wrote: 
Leif K-Brooks skrev:


But Python's DB-API (the standard way to connect to an SQL database
from Python) makes escaping SQL strings automatic. You can do this:

cursor.execute('UPDATE foo SET bar=%s WHERE id=%s', ["foo'bar", 123]) 


So. I've been writing SQL queries in Python like this, using PostgreSQL
and psycopg:

cursor.execute("select * from foo where bar=%s" % baz)

Is that wrong, and how should I have been supposed to know that this is
bad syntax? No doc I have seen actually has told me so.

It's *wrong* for some value of "wrong" - it does potentially introduce a SQL injection vulnerability into your code.

Suppose I provide as input into the baz variable

    1; drop table foo

Your statement then becomes

select * from foo where bar=1; drop table foo

which is clearly not such a good idea. More sophisticated attackes are possible, but this gives you the idea.

regards
 Steve
--
Steve Holden        +1 703 861 4237  +1 800 494 3119
Holden Web LLC             http://www.holdenweb.com/
Python Web Programming  http://pydish.holdenweb.com/

.

Relevant Pages

  • TSLSA-2005-0003 - multi
    ... Package name: bind clamav cpio cups mod_python perl postgresql python ... BIND includes a DNS server, ... Mod_python is a module that embeds the Python language interpreter within ...
    (Bugtraq)
  • [ANNOUNCE] pyPgSQL 2.5 released
    ... pyPgSQL is a Python database adapter for PostgreSQL databases. ... There is a source package and Windows binaries for Python 2.4. ... binaries are dynamically linked this time, so you will need a PostgreSQL ... Setting this attribute to 'text' will cause the query that will ...
    (comp.lang.python)
  • Re: your opinion about psycopg vs pygresql
    ... Ok so I installed PostGreSQL and pygresql since it looked like that this ... time I've noticed that python projects like Django seem to favor the ... psycopg module. ...
    (comp.lang.python)
  • Re: Python Database Apps
    ... What is your favorite python - database combination? ... make an app that has a local DB and a server side DB. ... I have had a lot of good luck with PostgreSQL. ... If an app comes already designed for mysql, oracle, sqlite, db2, dbm, ...
    (comp.lang.python)
  • your opinion about psycopg vs pygresql
    ... I'm playing a bit with PostgreSQL, in which I've set me the target to create a python script which with user input creates a new user role and a database with that owner (connecting to template1 since I know that at least that db exists). ... Now I know this could easily get into a flamewar, so if you comment I'll still investigate that, since at this moment I don't even have a clue how they differ and on what reason, why does PostgreSQL seem to favour pygresql and Pythoneers psycopg? ...
    (comp.lang.python)