mysqldb python escaping ? or %s?
- by asldkncvas
Dear Everyone,
I am currently using mysqldb.
What is the correct way to escape strings in mysqldb arguments?
Note that E = lambda x: x.encode('utf-8')
1) so my connection is set with charset='utf8'.
These are the errors I am getting for these arguments: w1, w2 = u'??', u'??'
1) self.cur.execute("SELECT dist FROM distance WHERE w1=? AND w2=?", (E(w1), E(w2)))
ret = self.cur.execute("SELECT dist FROM distance WHERE w1=? AND w2=?", (E(w1), E(w2)) )
File "build/bdist.linux-i686/egg/MySQLdb/cursors.py", line 158, in execute
TypeError: not all arguments converted during string formatting
2) self.cur.execute("SELECT dist FROM distance WHERE w1=%s AND w2=%s", (E(w1), E(w2)))
This works fine, but when w1 or w2 has \ inside, then the escaping obviously failed.
I personally know that %s is not a good method to pass in arguemnts due to injection attacks etc.
