Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

cursor.execute / parameter injection #239

Copy link
Copy link
@cil22

Description

@cil22
Issue body actions

Hello,

there is an example file showing an INSERT INTO via cursor.execute and concatenation the values via f string.
https://github.com/databricks/databricks-sql-python/blob/main/examples/insert_data.py

    squares = [(i, i * i) for i in range(100)]
    values = ",".join([f"({x}, {y})" for (x, y) in squares])

    cursor.execute(f"INSERT INTO squares VALUES {values}")

Is this supposed to be the future method?

Is it currently possible to pass the values with the parameters argument? If so, how would that look like (for multiple simultaneous records to be added)? cursor.executemany(...)?

I would expect less vulnerability to SQL injection and the benefit of automatic type conversion from that functionality.

Reactions are currently unavailable

Metadata

Metadata

Assignees

Labels

questionFurther information is requestedFurther information is requested

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.