3 ms·
Because they're both passed to "execute", which can't tell between the f-string and a non-interpolated query, so it just has to trust you did the right thing. T
by Izkata 2y ago
Because they're both passed to "execute", which can't tell between the f-string and a non-interpolated query, so it just has to trust you did the right thing. Typoing the "t" as an "f" introduces SQL injection that's hard to spot.
- vlovich123 2y agoAssuming `execute` takes both. You could have `execute(template)` and `execute_interpolated(str, ...args)` but yeah if it takes both you'll have challenges discouraging plain-text interpolation.
- Izkata 2y agoIt would have to be the other way around or be a (possibly major) breaking change. Just execute() with strings is already standard python that all the frameworks build on top of, not to mention tutorials: https://docs.python.org/3/library/sqlite3.html https://docs.python.org/3/library/sqlite3.html https://www.psycopg.org/docs/cursor.html https://www.psycopg.org/docs/cursor.html https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html https://dev.mysql.com/doc/connector-python/en/connector-pyth...
- dragonwriter 2y ago> It would have to be the other way around or be a (possibly major) breaking change. If it is going to reject the currently-accepted unsafe usage, its going to be a major breaking change in any case, so I don't see the problem. I mean, if you are lamenting it can't reject the currently-accepted SQL-interpolated-via-f-string because it can't distinguish it by type from plain strings with no interpolation, you are already saying that you want a major breaking change but are upset because the particular implementation you want is not possible. So you can't turn around and dismiss an alternative solution because it would be a major breaking change, that's what was asked for!
- zahlman 2y ago`execute` can tell the difference, because `t"..."` does not create the same type of object that `f"..."` does.