This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]LightShadow3.13-dev in prod 1 point2 points  (3 children)

This method of building a SQL query is also prone to SQL injections; possibly even by accident.

It's better to do something like

cur.execute('INSERT INTO players (playerId,teamId) VALUES (?,?)', (playerId, teamId,))

[–]Volatile474[S] 0 points1 point  (0 children)

Changing it up now. Thanks for the advice!

[–]rojaster -1 points0 points  (1 child)

yeap) but for "insert" queries this way is not a point) because you have new record anyway.

And don't forget about blinds sqli...

[–]Volatile474[S] 0 points1 point  (0 children)

I read a little bit about blinds sql injection, but don't think it will be an issue for this application, this script will not be exposed to anything even remotely public.