News for hackers. Stuff that matters.

A comment on Using Multi-Byte Characters to Nullify SQL Injection Sanitizing. Parent comment

Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by masklinn on Sunday June 26, 2016 @09:06AM (#11980599)
> A particular irritant is that most (all?) db APIs make it impossible to use parametrized queries with IN clauses

Psycopg2 has a generic adaptation of iterables to a form suitable for IN, but it's hand-rolled: https://github.com/psycopg/psycopg2/blob/732ea90a4ff85f6d0cc...

Real convenient though.

[ Parent | on HN ]

There are no comments on this comment yet.