[web2py] Re: Are executesql parameters escaped?

2017-01-13 Thread Jorrit
Thank you! On Friday, January 13, 2017 at 8:59:35 AM UTC+1, Niphlod wrote: > > when you do that, you're passing 'string'.format() (which is a string) to > executesql. > > the proper way is to use parameters!!! > > db.executesql('select * from auth_user where id = ?', placeholders=(1, ), >

[web2py] Re: Are executesql parameters escaped?

2017-01-13 Thread Niphlod
when you do that, you're passing 'string'.format() (which is a string) to executesql. the proper way is to use parameters!!! db.executesql('select * from auth_user where id = ?', placeholders=(1, ), as_dict=True) the nitty gritty details of the syntax depend on the driver parameter On