how to replace and string in a "SELECT ... IN ()"

[bcurtu]

Hi,

I have a BIIIIIG problem with the next query:

cursor.execute( """
SELECT titem.object_id , titem.tag_id
FROM tagging_taggedi tem titem
WHERE titem.object_id IN (%s)
""",( eid_list))

eid_list is suppossed to be a list of ids = [1,5,9]

How can I make it work?

Thanks

[Steve Holden]

Michael Mabin wrote:

Tino, dude, I'm afraid I lied about my previous post being the last
word. There are some things you said here that must be addressed.

Good grief, is there no utterance so inconsequential that you will walk
away from it without yet another round of retaliation?

I believe that all people were trying to convey is:

1. There are some data patterns that cannot be directly incorporated
into SQL statements without additional processing, regardless of whether
the "intention" of the data's originator is malevolent. A good example
is a string value containing an apostrophe, which in most SQL
implementations you can escape by preceding the apostrophe with another
apostrophe.

2. SQL drivers in Python are written so that no matter what the values
of the data may be, and no matter which backend they implement, data may
safely be passed as a tuple to a parameterized statement without such
cleansing because the drivers are written to ensure "dangerous" values
are appropriately handled.

Having said all that, if you are positive none of your string data
contains apostrophes you are, of course, free to build SQL statements
yourself - though doing so will on some systems lose you the speed
advantages offered by "prepared statements". Similarly, if you are *not*
positive of the quality of your data you are free to do the escaping in
your logic rather than using parameterized queries. This could be called
"buying a dog and barking yourself".

regards
Steve
--
Steve Holden [phone] [phone]
Holden Web LLC http://www.holdenweb.com/

[Lawrence D'Oliveiro]

In message <ma************ *************** ***********@pyt hon.org>, D'Arcy
J.M. Cain wrote:

On Fri, 26 Sep 2008 11:00:59 -0500
"Michael Mabin" <d3******@gmail .comwrote:

>So we can drop a table in an in clause? How is this a use case.
Cartoons are funny but actual proof that this example using an in-clause
provides an exploit would be more helpful I think.

I'm not sure what proof you require.

I would say Mr Mabin is displaying thinking characteristic of a PHP
programmer
<http://groups.google.c o.nz/group/nz.comp/msg/4c2a4d220499daf d>. :)