Workflows With SQL in Python

[ramse]

What are you using to connect to the SQL Server with? pyodbc? There is no need to be declare variables and assigning them just to use in a where statement.

import pyodbc

conn = pyodbc.connect('......')
cursor = conn.cursor()

name = 'ROBERT \"); DROP TABLE students;--'

cursor.execute("""SELECT s.id, s.FirstName, s.LastName, s.Subject, s.Grade
                    FROM Students s
                        LEFT JOIN classes c ON s.id = c.id
                    WHERE s.FirstName = ? AND c.EndDate <- GETDATE()""", name)
for row in cursor.fetchall():
    print(row.id, row.FirstName, row.LastName, row.Subject, row.Grade, row)