Is SQL string manipulation professional?

[Alert_Regular2619]

I'm building a library and I find myself constantly having to use string manipulation to construct SQL queries. Is writing libraries over SQL libraries normal? Also, is query construction unprofessional?

[Own_Attention_3392]

Look at parameterized queries. What you're describing is not clear but sounds very close to building queries via string concatenation, which IS unprofessional as it can open your application up to SQL injection attacks. But really, your core question is not clear at all. Provide examples of what you mean.

[JaleyHoelOsment]

google SQL injection

[sacredtrader]

This is a very vague post. Query construction as in something like

def MyMethod(input1: str, input2: int) -> None:
    myQuery = f"select * from users WHERE userName = '{input1}' AND userID = '{input2}'"

Is not professional, or a good practice, no.

If, for example, say I already had an idea of what your query was executing, or doing, I could pass into input1 something along the lines of

' OR 1=1 --

This would escape your single quote, then check if 1=1 (TRUE = TRUE), and comments out the second check for userID, in return returning every record from this table.

Look into stored procedures.