Make SQL Queries Secure in Python

Today we learn how to design secure SQL queries in Python when working with SQLite3.

◾◾◾◾◾◾◾◾◾◾◾◾◾◾◾◾◾
📚 Programming Books & Merch 📚

🌐 Social Media & Contact 🌐

[FreihEitner]

Thank you! I had always read one should use prepared statements because they are more secure but I never saw HOW they were more secure explained so neatly.

[kushalhu]

The best Example Course available in Internet.

[Lucan_]

Hello, can you make a tutorial on how to make async Api calls in background using any web framework of Python?

[HideBuz]

Your content is always top notch! Thanks!

[alexzakr]

Thanks for the simple explanation! It's really valuable!

[Mullheimer]

Wow, crazy speed and well explained. Thx

[lawrencedoliveiro]

I prefer to use APSW rather than the standard SQLite3 module that comes with Python. Also, here is a handy generator function I like to use, that performs a query and lets you iterate over the returned rows, putting them through an optional mapping function (e.g. turning the row tuple into a dict mapping field names to values) before returning them:

def db_iter(conn, cmd, values = None, mapfn = lambda x : x) :
for item in conn.cursor().execute(cmd, values) :
yield mapfn(item)
♯end for
♯end db_iter

[mehmetaliertorer]

Can you do a video about password authentication from the database but with hash encryptions

[RuneFToftlund]

great, excellent video. Maybe just slow down when executing and swapping window. Otherwise great.

[Trazynn]

I'd love more windows file handling tutorials. Your file renamer was ace.

[jeekakrishna]

it is so usefull for me...i was beggining to learn this database and python connection....Can you direct me some free database hosting solutions for begginers and how to use them ?

[ayushpurohit]

Does it work for python/mysql connector? Also, how is this different from f-string or .format()?

[walkaisa]

What’s the name of the sql syntax highlighting extension?

[piotrmazgaj]

Hi, I have a similar problem but it concerns the tables' name. I need to create many, many tables (each table for separate stock data and stock name is a table name). How can I put into my SQL query table name as variable, but without breaching the sanitation rule?