Etienne Trimaille via QGIS-Developer <[email protected]>
writes:
> As Julien said, It seems that just a call to "format" with a Python
> dictionary might be enough for now :
>
> sql = "SELECT * FROM {schema}.foo"params = {
> "schema": "test",
> }sql = sql.format(**params)
(That code is hard to read given likely bad HTML formatting, but I get
the point.)
How is this different from telling the scanner to ignore it? It seems
like laundering input via steps the scanner doesn't follow.
_______________________________________________
QGIS-Developer mailing list
[email protected]
List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
