Groups | Search | Server Info | Login | Register

Groups > comp.databases > #18904

Quoting SQL Strings

Show all headers | View raw

People see dynamic generation of SQL queries as some kind of black art. 
“Use templates and prepared statements”, they say. “Fear the SQL injection 
attack”, they say.

Turning a string value into a literal for use in an SQL query is really 
very simple. In Python, this is all it takes:

    "'" + s.replace("'", "''") + "'"

Back to comp.databases | Previous | Next | Find similar

Thread

Quoting SQL Strings Lawrence D'Oliveiro <ldo@nz.invalid> - 2024-04-29 02:53 +0000

csiph-web