string interpolation in SQL query: dangerous and/or wrong? (python)

Question

We all know the story of Bobby Tables and not to just use simple string interpolation with strings that come from users.

But what I'm wondering is whether it's OK to use string interpolation from my own hardcoded strings.

For example, I see no way this is dangerous, but I want to make sure. And if it is simply the wrong way to go about it for some non-security reason I'd like to know that, too.

table_dict = {'option1':'table_1','option2':'table_2'}

query_string = "SELECT * FROM {}".format(table_dict[string_from_front_end])

Obviously this is a far simpler example than what I intend to actually do -- my real query is much longer --, but my question is about that string interpolation.

Is it safe?
Is there a better way I should be doing this?

There isn't much you can do other than string interpolation with queries like this. Prepared statements cannot be used to dynamically specify table/column names. — Phylogenesis
– Phylogenesis, Commented Jun 21, 2017 at 16:11

ngoue · Accepted Answer · 2017-06-21 16:32:44Z

1

As long as the query will never include user input, then it's fine.

Though I would recommend using an ORM where possible, as they are often written to handle string interpolation.

answered Jun 21, 2017 at 16:32

ngoue

1,0551 gold badge14 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

string interpolation in SQL query: dangerous and/or wrong? (python)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related