forked from Rookout/tutorial-python
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsql_inj.py
More file actions
19 lines (14 loc) · 667 Bytes
/
Copy pathsql_inj.py
File metadata and controls
19 lines (14 loc) · 667 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
from django.conf.urls import url
from django.db import connection
def show_user(request, username):
with connection.cursor() as cursor:
# BAD -- Using string formatting
cursor.execute("SELECT * FROM users WHERE username = '%s'" % username)
user = cursor.fetchone()
# GOOD -- Using parameters
cursor.execute("SELECT * FROM users WHERE username = %s", username)
user = cursor.fetchone()
# BAD -- Manually quoting placeholder (%s)
cursor.execute("SELECT * FROM users WHERE username = '%s'", username)
user = cursor.fetchone()
urlpatterns = [url(r'^users/(?P<username>[^/]+)$', show_user)]