I wrote fairly recently about SQL Injection in Python at http://www.simple-talk.com/sql/learn-sql-server/sql-injection-defense-in-depth/ http://www.simple-talk.

I wrote fairly recently about SQL Injection in Python at http://www.simple-talk.com/sql/learn-sql-server/sql-injection-defense-in-depth/ http://www.simple-talk.com/sql/learn-sql-server/sql-injectio... . I do not address web stacks directly there, but Python itself will happily let you use prepared statements, it is up to the programmer to take effective steps to prevent SQL Injection.