parameterized query Postgres for sql injection mitigation

Question

stmt = "SELECT filecontent FROM filecontent WHERE filecontent_id = %d AND filecontent LIKE '%% %s %%'"%(int(result_file_pri[0]),str(myjson['recordType']))
curs.execute(stmt)

Trying to conevert above postgres query to parameterized query to itigate sql injection. The solution I found on internet is to include stmt in execute statement and take %s out of quotes i.e

curs.execute("SELECT filecontent FROM filecontent WHERE filecontent_id = %s AND filecontent LIKE %% %s %%",(int(result_file_pri[0]),str(myjson['recordType'])))

The above doesn't work for %% %s %% for me, how do I rectify the problem?

zerkms · Accepted Answer · 2015-09-16 08:45:59Z

2

It should be the parameter that holds the percent character:

curs.execute("SELECT filecontent FROM filecontent WHERE filecontent_id = %s AND filecontent LIKE %s",
             (int(result_file_pri[0]), str("%" + myjson['recordType'] + "%")))
                                            ^----------------------------^
                                                    so the wildcard is the
                                                     part of the parameter

edited Sep 16, 2015 at 8:45

answered Sep 16, 2015 at 8:43

zerkms

256k73 gold badges447 silver badges551 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

parameterized query Postgres for sql injection mitigation

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related