Re: [DB-SIG] mysql module embeds params in command string

2013-07-19 Thread Michael Bayer
On Jul 19, 2013, at 12:06 AM, Carl Karsten wrote: > That 1/2 answers my question - and it sounds correct for what you are saying. > > But I am wondering why they picked that one.Yeah Yeah "Ask them" > is the obvious answer :) oh, well MySQLdb has been around way longer than all the others.

Re: [DB-SIG] mysql module embeds params in command string

2013-07-18 Thread Carl Karsten
That 1/2 answers my question - and it sounds correct for what you are saying. But I am wondering why they picked that one.Yeah Yeah "Ask them" is the obvious answer :) I am also wondering why so many exist. I would think after a year or 2 they would all merge together. I have trouble trying

Re: [DB-SIG] mysql module embeds params in command string

2013-07-18 Thread Michael Bayer
If I had to guess why Django has a statement like that up, they may not have worked out their driver architecture such that they can easily swap out various DBAPI implementations on top of the same database backend; i.e. they probably have a "mysql.py" module with a big "import MySQLdb" hardcod

Re: [DB-SIG] mysql module embeds params in command string

2013-07-18 Thread Carl Karsten
Huh, I didn't know there were any other options. I wonder why this says this: MySQLdb is the Python interface to MySQL. Version 1.2.1p2 or later is required for full MySQL support in Django. https://docs.djangoproject.com/en/1.5/ref/databases/#mysqldb On Thu, Jul 18, 2013 at 9:08 AM, Michael

Re: [DB-SIG] mysql module embeds params in command string

2013-07-18 Thread Michael Bayer
On Jul 18, 2013, at 9:38 AM, Carl Karsten wrote: > I feel I need to post this now and then in hopes I find someone who > can do something about it. This might even be worth some PSF funding? > > I am not a security expert, I am not qualified to asses the risk, it > doesn't matter if I consider

Re: [DB-SIG] mysql module embeds params in command string

2013-07-18 Thread M.-A. Lemburg
Carl Karsten wrote: > I feel I need to post this now and then in hopes I find someone who > can do something about it. This might even be worth some PSF funding? > > I am not a security expert, I am not qualified to asses the risk, it > doesn't matter if I consider this a vulnerability. That sai