Python SQL DB string literals and escaping -
anyone know if mysqldb automatically escape string literals sql statements?
for instance trying execute following:
cursor.execute("""select * `accounts` `account_name` = 'blah'""")
will escape account name automatically? or escape if following?:
x = 'blah' cursor.execute("""select * `accounts` `account_name` = %s""", (x))
or both? can clarify can't find information on it.
there no escaping in first example, raw sql query. it's valid, it'll work, makes sense if want search account blah
.
when need account name in variable, need parameterised version. example may not work expected (x)
isn't tuple, it's value x
. x
in tuple sequence (x,)
. avoid confusion may prefer use list [x]
.
Comments
Post a Comment