News for hackers. Stuff that matters.

A comment on Show HN: Inline SQL in any Python program.

Re:Show HN: Inline SQL in any Python program by rubenfiszel on Saturday October 08, 2022 @03:52PM (#33135428)
Something was not clear to me from the README. When you do string interpolations as in your examples, those are actually prepared sql statements right ? Otherwise it would open the way for sql injections.
[ Parent | on HN ]
Re:Show HN: Inline SQL in any Python program by ekzhang on Saturday October 08, 2022 @04:13PM (#33135606)
Yep, they're prepared SQL statements. Literal string interpolation would be unacceptable in any self-respecting SQL library: it's parameters. Good question though!
[ Parent | on HN ]