Date: Sun, 27 Apr 2008 11:55:18 -0400
From: Joe <dev@freedomcircle.net>
Subject: Re: Protection from SQL injection
In-reply-to: <20080427142253.449de600@dawn.webthatworks.it>
To: Ivan Sergio Borgonovo <mail@webthatworks.it>
Cc: pgsql-sql@postgresql.org
Message-id: <4814A1E6.1070200@freedomcircle.net>
MIME-version: 1.0
Content-type: text/plain; charset=US-ASCII; format=flowed
Content-transfer-encoding: 7bit
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<fv0727$cge$1@ger.gmane.org>
	<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
	<13670.1209267734@sss.pgh.pa.us>
	<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
	<20080427123848.5c841788@dawn.webthatworks.it>
	<20080427142253.449de600@dawn.webthatworks.it>
User-Agent: Mozilla-Thunderbird 2.0.0.9 (X11/20080110)

Ivan Sergio Borgonovo wrote:
> It'd be nice to have a wrapper that let you write prepared statements
> this way:
>
> "select a.id, b.name from a join b on a.id=b.id where
> a.status=$variable1 and b.id>$variable2 etc... but that's a pretty
> good change to any language parser.
>   

Python already supports something like that. See PEP 249 
(http://www.python.org/dev/peps/pep-0249/), under Module Interface, the 
description of the paramstyle parameter. Psycopg2 supports both the 
"format" (C printf) and "pyformat" styles. See the last section on this 
page for an example using the pyformat style: 
http://www.devx.com/opensource/Article/29071/0/page/3.

Joe