1. Forum
  2. Usenet
  3. COMP.DATABASES

  • Quoting SQL Strings

    From Lawrence D'Oliveiro@21:1/5 to All on Mon Apr 29 02:53:46 2024
    People see dynamic generation of SQL queries as some kind of black art.
    “Use templates and prepared statements”, they say. “Fear the SQL injection
    attack”, they say.

    Turning a string value into a literal for use in an SQL query is really
    very simple. In Python, this is all it takes:

    "'" + s.replace("'", "''") + "'"

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)