Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #48552

Re: Updating a filename's counter value failed each time

Show key headers only | View raw

On 17/06/2013 19:32, Jens Thoms Toerring wrote:
> Νίκος <support@superhost.gr> wrote:
>> On 17/6/2013 8:54 μμ, Jens Thoms Toerring wrote:
>> > Also take care to check the filename you insert - a malicous
>> > user might cobble together a file name that is actually a SQL
>> > statement and then do nasty things to your database. I.e. never
>> > insert values you received from a user without checking them.
>
>> Yes in generally user iput validation is needed always, but here here
>> the filename being selected is from an html table list of filenames.
>
>> But i take it you eman that someone might tried it to pass a bogus
>> "filename" value from the url like:
>
>> http://superhost.gr/cgi-bin/files.py?filename="Select....."
>
>> Si that what you mean?
>
> Well, you neer wrote where this filename is coming from.
> so all I could assume was that the user can enter a more
> or less random file name. If he only can select one from
> a list you put together there's probably less of a problem.
>
>> But the comma inside the execute statement doesn't protect me from such
>> actions opposed when i was using a substitute operator?
>
>> > I would guess because you forgot the uotes around string
>> > values in your SQL statement which thus wasn't executed.
>
>> i tried you suggestions:
>
>> cur.execute('''UPDATE files SET hits = hits + 1, host = %s, lastvisit =
>> %s WHERE url = "%s"''', (host, lastvisit, filename) )
>
>> seems the same as:
>
>> cur.execute('''UPDATE files SET hits = hits + 1, host = %s, lastvisit =
>> %s WHERE url = %s''', (host, lastvisit, filename) )
>
>> since everything is tripled quoted already what would the difference be
>> in "%s" opposed to plain %s ?
>
> As I wrote you need *single* quotes around strings in
> SQL statements. Double quotes won't do - this is SQL
> and not Python so you're dealing with a different lan-
> guage and thus different rules apply. The triple single
> quotes are seen by Python, but SQL needs its own.
>
The query looks safe to me as he _is_ using a parametrised query.

Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Updating a filename's counter value failed each time Simpleton <support@superhost.gr> - 2013-06-17 19:39 +0300
  Re: Updating a filename's counter value failed each time MRAB <python@mrabarnett.plus.com> - 2013-06-17 18:40 +0100
    Re: Updating a filename's counter value failed each time Νίκος <support@superhost.gr> - 2013-06-17 20:51 +0300
  Re: Updating a filename's counter value failed each time John Gordon <gordon@panix.com> - 2013-06-17 17:40 +0000
  Re: Updating a filename's counter value failed each time jt@toerring.de (Jens Thoms Toerring) - 2013-06-17 17:54 +0000
    Re: Updating a filename's counter value failed each time Νίκος <support@superhost.gr> - 2013-06-17 21:06 +0300
      Re: Updating a filename's counter value failed each time jt@toerring.de (Jens Thoms Toerring) - 2013-06-17 18:32 +0000
        Re: Updating a filename's counter value failed each time MRAB <python@mrabarnett.plus.com> - 2013-06-17 19:47 +0100
          Re: Updating a filename's counter value failed each time jt@toerring.de (Jens Thoms Toerring) - 2013-06-17 19:16 +0000
            Re: Updating a filename's counter value failed each time Alister <alister.ware@ntlworld.com> - 2013-06-17 20:33 +0000
      Re: Updating a filename's counter value failed each time Alister <alister.ware@ntlworld.com> - 2013-06-17 19:05 +0000
        Re: Updating a filename's counter value failed each time Νίκος <support@superhost.gr> - 2013-06-17 22:30 +0300
          Re: Updating a filename's counter value failed each time Alister <alister.ware@ntlworld.com> - 2013-06-17 20:26 +0000
            Re: Updating a filename's counter value failed each time Alister <alister.ware@ntlworld.com> - 2013-06-17 20:43 +0000
    Re: Updating a filename's counter value failed each time Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2013-06-17 19:30 -0400
      Re: Updating a filename's counter value failed each time Νίκος <support@superhost.gr> - 2013-06-18 03:25 +0300
  Re: Updating a filename's counter value failed each time John Gordon <gordon@panix.com> - 2013-06-17 19:19 +0000
    Re: Updating a filename's counter value failed each time Νίκος <support@superhost.gr> - 2013-06-17 22:28 +0300
      Re: Updating a filename's counter value failed each time Alister <alister.ware@ntlworld.com> - 2013-06-17 20:39 +0000
        Re: Updating a filename's counter value failed each time John Gordon <gordon@panix.com> - 2013-06-17 20:44 +0000
          Re: Updating a filename's counter value failed each time Alister <alister.ware@ntlworld.com> - 2013-06-17 20:49 +0000
          Re: Updating a filename's counter value failed each time MRAB <python@mrabarnett.plus.com> - 2013-06-17 23:22 +0100
            Re: Updating a filename's counter value failed each time Νίκος <support@superhost.gr> - 2013-06-18 02:11 +0300
              Re: Updating a filename's counter value failed each time Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2013-06-17 21:42 -0400
                Re: Updating a filename's counter value failed each time Νίκος <support@superhost.gr> - 2013-06-18 08:49 +0300
                Re: Updating a filename's counter value failed each time Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2013-06-18 19:56 -0400
              Re: Updating a filename's counter value failed each time Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2013-06-17 22:01 -0400
  Re: Updating a filename's counter value failed each time Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2013-06-17 23:18 +0000
  Re: Updating a filename's counter value failed each time Νίκος <support@superhost.gr> - 2013-06-18 03:22 +0300

csiph-web