Re: SQL injection in a ~ or LIKE statement

On Oct 22 02:33, Uwe C. Schroeder wrote:
> On Sunday 22 October 2006 12:32, Volkan YAZICI wrote:
> > If I were you, I'd ask psycopg2 developers to implement parameters that
> > are natively supported by PostgreSQL. With parameters, you won't mess up
> > with any escaping or injection related issue.
>
> psycopg2 supports parameters which are escaped properly.

You're wrong. psycopg uses Python style parameters and escapes the
specified input before inserting into query string. See documentation of
PQexecParams() for the "parameters" I mentioned. I think, you're
confusing terms. I just checked psycopg2 source code and couldn't see
any parameter implementation.


Regards.