python and sqlite - escape input

Question

When using Python with SQLite DB, how to escape the data going in and pulling the data coming out?

Using pysqlite2

dns · Accepted Answer · 2019-11-03 18:54:38Z

24

Use the second parameter args to pass arguments; don't do the escaping yourself. Not only is this easier, it also helps prevent SQL injection attacks.

cursor.execute(sql,args)

for example,

cursor.execute('INSERT INTO foo VALUES (?, ?)', ("It's okay", "No escaping necessary") )

edited Nov 3, 2019 at 18:54

dns

2,8331 gold badge29 silver badges34 bronze badges

answered Oct 17, 2010 at 8:30

unutbu

886k197 gold badges1.9k silver badges1.7k bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Wizzard Over a year ago

Thanks, I wasn't sure of the python way, I am well aware of SQL attacks which is why I am trying to find best way in python. Thanks, will see if there is any more comments on this and give it a go.

eumiro Over a year ago

@Wizzard, unutbu is right, this works and will save you a lot of headache. For the other part of your question: pysqlite2 will return to you the objects from the DB in the right format, so you can directly use them as int, float, string, datetime,...

Collectives™ on Stack Overflow

python and sqlite - escape input

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related