Re: [Tutor] Paramstyle/sql injection [was Python CGI Script]

2006-09-20 Thread Danny Yoo
> Was talking to my partner about this. He's a perl programmer, and he > told me that (if I understood him correctly) that the programmer is > required by perl to use the 'prepare' function in the perl DBI prior to > sending a select statement. Hi Tim, Yes. That being said, Perl's prepare() s

[Tutor] Paramstyle/sql injection [was Python CGI Script]

2006-09-20 Thread Tim Johnson
* Danny Yoo <[EMAIL PROTECTED]> [060920 10:41]: > >query1 = """SELECT ABC FROM %s limit %s,%s"""\ > > % (self.tableid,self.rangeid1,self.rangeid2) > > Just as a note: please don't do this! *grin* > > Don't build query strings up like this: this is very prone to an SQ