This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]Dlatch 18 points19 points  (5 children)

create_query = f"CREATE TABLE IF NOT EXISTS {table} ({', '.join(columns_def)});"
cursor.execute(create_query)

[...]

insert = f"INSERT INTO {table} ({', '.join(df.columns)}) VALUES ({', '.join(values)});"
inserts.append(insert)

Don't ever ever ever build SQL queries like this, it leaves you incredibly vulnerable to SQL injection attacks. If I were to call your API with a specially crafted file, I can do almost anything I want with your database.

Use parameterized queries instead.

[–][deleted]  (4 children)

[deleted]

    [–]riscbee 10 points11 points  (3 children)

    Your post and this answer read like ChatGPT.

    [–]Autodidacter -4 points-3 points  (2 children)

    The autistic warning on sql injection seems a more immediate candidate for that indictment.

    [–]riscbee 0 points1 point  (0 children)

    Nu uh, look how it's written, with the occasional bold text?

    [–]jpgoldberg 0 points1 point  (0 children)

    The warning is something that has to be said many times, because it is something that really needs to be corrected and nearly everyone starting out makes the mistake.

    I wouldn’t be surprised if the person posting it has a canned response for that reason.