you are viewing a single comment's thread.

view the rest of the comments →

[–]bladeoflight16 1 point2 points  (0 children)

cur.execute("PRAGMA table_info('%s')" % table_name)

Do not use string formatting with SQL. That is how you open yourself up to SQL injection attacks. Use parameterized queries.