Preventing SQL Injection Attacks With Python
How to safely compose any query in Python
SQL injection are constantly ranked among the most common attacks against systems. For this reason, ORM’s offer many ways of dealing with injections. A common solution is bind variables, a placeholder in the query that is sanitized by the ORM for safe execution in the database.
However, while binding values is very common, I often find myself needing to use table and column names as variables as well. A stroll through
psycopg2's documentation led me to the discovery of
psycopg2.sql.Literal, two low-level functions for safely binding any type of variable in a query.
This discovery sparked my fourth article for RealPython, “Preventing SQL Injection Attacks With Python”. If you’re not sure what SQL injection is, this article will walk you through everything you need to know. If you are an ORM veteran, check your knowledge and get yourself familiar with the low level