Home/ Questions/Q 7952447
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-04T02:51:51+00:00

I have been told the following is insecure: cursor.execute(SELECT currency FROM exchange_rates WHERE date=’%s’%(self.date))

  • 0

I have been told the following is insecure:

cursor.execute("""SELECT currency FROM exchange_rates WHERE date='%s'"""%(self.date))

Why exactly is the '%s' bad? How would someone actually do a SQL injection here?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Imagine if self.date is "'; DROP TABLE exchange_rates --". Then you’ll execute:

    SELECT currency FROM exchange_rates WHERE date=''; DROP TABLE exchange_rates -- '

    and boom, you’re hosed. You have to escape the ' so the value of self.date will be completely contained in the string, not executed as a query.

    • 0