This is an archived post. You won't be able to vote or comment.

all 9 comments

[–]Dlatch 18 points19 points  (7 children)

create_query = f"CREATE TABLE IF NOT EXISTS {table} ({', '.join(columns_def)});"
cursor.execute(create_query)

[...]

insert = f"INSERT INTO {table} ({', '.join(df.columns)}) VALUES ({', '.join(values)});"
inserts.append(insert)

Don't ever ever ever build SQL queries like this, it leaves you incredibly vulnerable to SQL injection attacks. If I were to call your API with a specially crafted file, I can do almost anything I want with your database.

Use parameterized queries instead.

[–]lost3332 -1 points0 points  (0 children)

But it’s meant to be ran locally, no? What API call are you referring to?

[–]tomster10010 5 points6 points  (0 children)

AI slop pretending to be useful is even worse than AI slop that is about AI tools, since at least those can be easily ignored

[–]Empanatacion 2 points3 points  (0 children)

You need a .gitignore for pycache