Python: best practice and securest way to connect to MySQL and execute queries

by

To avoid injections, use execute with %s in place of each variable, then pass the value via a list or tuple as the second parameter of execute. Here is an example from the documentation:

c=db.cursor()
max_price=5
c.execute("""SELECT spam, eggs, sausage FROM breakfast
          WHERE price < %s""", (max_price,))

Note that this is using a comma, not % (which would be a direct string substitution, not escaped). Don’t do this:

c.execute("""SELECT spam, eggs, sausage FROM breakfast
          WHERE price < %s""" % (max_price,))

In addition, you must not use single quotes around the position holder ('%s') if the parameter is a string as the driver provides these.

More Related Contents:

  1. Passing table name as a parameter in psycopg2
  2. How can I connect to MySQL in Python 3 on Windows?
  3. memory-efficient built-in SqlAlchemy iterator/generator?
  4. Install mysql-python (Windows)
  5. When to close cursors using MySQLdb
  6. Installing MySQL Python on Mac OS X
  7. How to build a flask application around an already existing database?
  8. Can’t connect to local MySQL server through socket ‘/tmp/mysql.sock
  9. SQLAlchemy ON DUPLICATE KEY UPDATE
  10. Python 3.4.0 with MySQL database
  11. Python MySql Insert not working
  12. What is the best solution for database connection pooling in python?
  13. Using MySQL in Flask
  14. trapping a MySql warning
  15. Repeated MySQL queries from Python return the same data [duplicate]
  16. Python mySQL Update, Working but not updating table
  17. ImportError: No module named ‘MySQL’
  18. Python import MySQLdb error – Mac 10.6
  19. mysql-python installation problems (on mac os x lion)
  20. How to make an Inner Join in django?
  21. Dynamic SQL Queries with Python and mySQL
  22. Simple Subquery with OuterRef
  23. Reverse engineer SQLAlchemy declarative class definition from existing MySQL database?
  24. Print results in MySQL format with Python
  25. Python’s MySqlDB not getting updated row
  26. Django + MySQL on Mac OS 10.6.2 Snow Leopard
  27. Imploding a list for use in a Python MySQL IN clause
  28. flask-login: can’t understand how it works
  29. A good way to escape quotes in a database query string?
  30. How to disable query cache with mysql.connector

Leave a Comment