2 ms·
Proposed safe(r) API via decorated methods: QParams = sqlbind.Dialect.some_dialect @QParams def make_my_query(value1: str, value2: int): r
by Retr0id 3y ago
Proposed safe(r) API via decorated methods:
QParams = sqlbind.Dialect.some_dialect
@QParams
def make_my_query(value1: str, value2: int):
return f'SELECT * FROM table WHERE field1 = {value1} AND field2 > {value2}'
data = connection.execute(*make_my_query(foo, bar))
Obviously this wouldn't work as-is, QParams would need to be modified to support this. The decorator would wrap the method, sanitising the args before they're even passed to the wrapped function.
Edit: actually, I might've misunderstood what sqlbind is doing internally, maybe this approach doesn't quite make sense
Edit 2: Like so: https://github.com/baverman/sqlbind/issues/1 https://github.com/baverman/sqlbind/issues/1
- chrisjc 3y agoIf I understand your code correctly, you are bypassing DBAPI's binding functionality and opening yourself up for SQL injection. QParams = sqlbind.Dialect.some_dialect @QParams def make_my_query(value1: str, value2: int): # SELECT * FROM table WHERE field1 = ? AND field2 > ? return f'SELECT * FROM table WHERE field1 = {value1} AND field2 > {value2}' data = connection.execute(*make_my_query(foo, bar), [foo, bar])