How to escape characters before inserting in sql query?

Question

SQL

Hello! There is a rather large raw sql query in a flask application. There is an ORM SQLAlchemy, but, as I said, the query is too large to write it using orms, and besides, the query text is collected on the fly, depending on various conditions. To avoid SQL injection, characters contained in variables must be escaped before being inserted into a query. How can I do that? Perhaps there are some other options on how to collect and execute the request? Variables are inserted into the query by normal string concatenation.

Answer 1

Collect a string and write% instead of variables, simultaneously collecting a list of variables, then execute through execute, orm will do everything by itself. The Mysql driver for python has an escape_string() function if it's so hard for you.