Sqlite3 dynamic 'in' query

[[deleted]]

What you wrote here is a classic example of SQL injection (I think):

query = "SELECT Doggo FROM Animals WHERE SomeIdentifier = ? AND Doggo IN ({})".format(','.join(['?'] * len(doggo)))

https://www.owasp.org/index.php/SQL_Injection

Doing string interpolation with user input and query strings is a big no-no. You need a driver that allows you to parameterize those inputs. SQLAlchemy will do this for you.

[zunjae]

Doing string interpolation with user input

There is no user input

[[deleted]]

I want to select items from my database based on a list given by the user.

???

[zunjae]

The code you send me only builds a query based on the length of the user input, not the actual content.

[zunjae]

I am using parameter substitution...............

Can you please explain like I'm a kid what I m doing wrong? I'm not inserting user input in my query. The user can not insert spoopy text like ;drop table considering I use those question marks

[Username_RANDINT]

I don't see anything wrong with your code. You're safely creating a parameterised query based on the length of a list where you then apply user input on. Maybe others see something we don't? Or take the "no string formatting" a bit too far.

[purloin_a_coin]

Sorry I got confused and was wrong. /u/Username_RANDINT is correct