SQL Injection Prevention in Python - is using parameterized query enough?

Question

I have the following python code:

row = conn.execute('''SELECT admin FROM account WHERE password = ?''',
(request.headers.get('X-Admin-Pass'),)).fetchone()

My question is whether this code is secure for SQL injection? Since I use parameterized query it should be. However, since I am passing user information straight from the header, I am a little worried :)

Any thoughts about the issue?

Let's just hope that this is an example code where you put the part you are hashing the password out. — Işık Kaplan
– Işık Kaplan, Commented Sep 13, 2019 at 20:15

nmichaels · Accepted Answer · 2011-03-22 17:30:58Z

2

The way that you are inserting the data into the database will ensure that an SQL attack will not work, the execute method will automatically escape the parameters that you passed as a tuple as its second parameter to the query.

You are doing that correctly.

edited Mar 22, 2011 at 17:30

nmichaels

51.2k12 gold badges113 silver badges137 bronze badges

answered Mar 22, 2011 at 17:29

Dominic Santos

1,96014 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

krs1 · Accepted Answer · 2011-03-22 17:33:32Z

1

If your module uses the DBI specs, then you're parameterizing fine. Unless you want to do research into preventing specific SQL attacks, paramterizing your queries is a good umbrella against SQL injection.

answered Mar 22, 2011 at 17:33

krs1

1,1357 silver badges16 bronze badges

Collectives™ on Stack Overflow

SQL Injection Prevention in Python - is using parameterized query enough?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related