[Answer]-Error to use django cursor to save escaped characters

by

1👍

✅

You’re opening yourself up for a possible SQL injection. Instead, use c.execute() properly:

url = "http://www.academicjournals.org/ijps/PDF/pdf2011/18mar/G%C3%B3mez-Berb%C3%ADs et al.pdf"
dbquery = "INSERT INTO main_crawl_document SET url=?" 
c.execute(dbquery, (url,)) 
transaction.commit_unless_managed()

The .execute method should accept an iterable of parameters to use for escaping, assuming it’s the normal dbapi method (which it should be with Django).

👤Colin Dunklau

Leave a comment