SQL injection , use parameter [duplicate]

Question

i have this SQL

default code is a string

cr.execute(
                    '''SELECT product FROM product_product
                       WHERE default_code = '%s' limit 1'''
                    % (default_code,)
                )

and linter gets me an erro E8103: SQL injection risk. Use parameters if you can.

same with other SQL

cr.execute(
                        f"SELECT id FROM product_supplierinfo"
                        f" WHERE product_tmpl_id = {str(product_tmpl)}"
                        f" AND name = {partner.id}"
                    )

The linter is telling you the problem and the solution... your code (both examples) has an SQL injection risk and the solution is to use parameters (in both cases you can) — Jiří Baum
– Jiří Baum, Commented Sep 9, 2022 at 12:39

ssanga · Accepted Answer · 2022-09-09 12:38:30Z

2

It is recommended to set the queries this way:

query = """Update employee set Salary = %s where id = %s"""
tuple1 = (8000, 5)
cursor.execute(query, tuple1)

More info here: https://pynative.com/python-mysql-execute-parameterized-query-using-prepared-statement/

answered Sep 9, 2022 at 12:38

ssanga

3634 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

SQL injection , use parameter [duplicate]

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related