> Was talking to my partner about this. He's a perl programmer, and he
> told me that (if I understood him correctly) that the programmer is
> required by perl to use the 'prepare' function in the perl DBI prior to
> sending a select statement.
Hi Tim,
Yes. That being said, Perl's prepare() statement is no guarantee to safe
code. It leaves one to face interpolation temptation:
## Perl
my $sth = $dbh->prepare("delete from some_table where
name='$field_value'");
$sth->execute();
is just as dangerous as:
## Python
cursor = conn.cursor()
cursor.execute("delete from some_table where name = '%s'" %
field_value)
The lesson is that, in the absence of some automated lint-like tool
support that can tell us "no you silly, don't do that", we humans are
going to have to pick up the slack. We can write bad code in pretty much
any language. Programmer education is something we need to do until then.
Most of the developer communities around these languages have been around
long enough to understand this common risk of SQL injection. In summary:
if we're going to work with databases, we should use prepared statements
unless we have a very good reason not to.
_______________________________________________
Tutor maillist - Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor
