Re: Sql injection attacks

    Python has an interface like this :

    params = { 'mystrfield': 'hello', 'myintfield': 5 }

    cursor.execute( "SELECT myfield FROM mytable WHERE
mystrfield=%(foo)s AND myintfield=%(bar)d;" , params )

    It has the following advantages :
    - separation of sql from data
    - named parameters
        - no problem with order
        - one parameter can be reused several times
    - automatic escaping of strings
    - automatic enforcement of int, float etc types with %d and %f (throws an
exception otherwise)

    The only problem so far with Python's dbapi is that it does not
understand arrays so they have to be stringified first.