Re: Checking each item in m.group()?

On Jun 2, 5:06 pm, Peter Otten <__pete...@xxxxxx> wrote:

You are taking the wrong approach here.

Don't build SQL statements as strings; you are enabling the next SQL
injection attack. Pass parameters using the DB API instead.

Don't use regular expressions to parse a CSV file. Python's csv module is
more likely to deal correctly with the quirks of that standard.


I'd like to second both these statements. Regardless of whether these
CSV files are from a trusted source or not, it's a virtual truism of
programming that eventually, any application will be used in ways it
was not intended. Since using a parameterized query is a simple way
to avoid a common security hole, even if such a thing could never be
exploited by the app in its current configuration, you should do
things the Right Way. That way, even if your code is twisted to some
other use in the future, it's less likely to cause problems.
.

Relevant Pages

  • Re: That Syncing feeling
    ... I been asked to write a small app that syncs a local ... CSV file with a MySQL table. ... I can read in the file OK and run SQL statements OK ...
    (alt.comp.lang.borland-delphi)
  • That Syncing feeling
    ... I been asked to write a small app that syncs a local ... CSV file with a MySQL table. ... I can read in the file OK and run SQL statements OK ...
    (alt.comp.lang.borland-delphi)
  • Sort-of parse SQL
    ... I get SQL statements that include columns which aren't real columns and need ... I'm looking for a way to parse the sql to find these columns ... Prev by Date: ...
    (microsoft.public.dotnet.framework.adonet)
  • Parsing SQL Statements and retaining comments
    ... I'm trying to parse my sql statements and i've to retain the ... Any help on how to retain the comments and indentation after ... SQL Pgmr ...
    (comp.compilers.tools.javacc)