A
A
Averyanalex2020-06-10 11:54:06
MySQL
Averyanalex, 2020-06-10 11:54:06

How to protect against sql injection in PyMySQL?

Searched, did not find. Everyone writes what SQL injections are and how to protect against them in php using mysql_real_escape_string or something similar. I'm making a bot that saves some data in MariaDB. It seems that you can protect yourself by shielding - what and how to shield? What characters to replace? Send data separately from SQL query - how is it done in PyMySQL? Please help, otherwise soon someone will change the language to "ru'; DROP TABLE guilds;" ;)

Answer the question

In order to leave comments, you need to log in

2 answer(s)
S
Sergey Tikhonov, 2020-06-10
@Averyanalex

cursor.execute(sql="SELECT %s", params=(1,))
That's all the magic.

A
Averyanalex, 2020-06-10
@Averyanalex

Thank you so much, but it will be correct here
cursor.execute("SELECT %s", (1,))
He swears at unknown sql

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question