How To Sanitize Sql Query

[kate 5]

Hi

 

Is there any command in ubot studio 5 to sanitize SQL Query ?

 

I cant find it in current Ubot(5.9.33). I think its crucial feature that missing from database command (if its true there's no feature like this).

Simple regex to replace " ' " is not adequate, 

Here is why: 

http://stackoverflow.com/questions/8506574/sql-injection-isnt-replace-good-enough

 

Workaround i can think of:

 

1. Develop plugin to do this ("escape sql" command, or better, parameter binding.)

2. Using python to sanitize

3. Using php to sanitize

4. Using online database

 

 

All database that ubot studio 5 supported need this feature.

1.  SQLLite currently has problem )

2. There is open issue about this

Edited August 21, 2016 by kate

[HattoriHanzo 5]

Using python you can do parameter substitution for sql  - this will take care of all sanitizing

 

As an added advantage you will also be able to set things like connection timeouts etc

[kate 5]

Using python you can do parameter substitution for sql  - this will take care of all sanitizing

 

As an added advantage you will also be able to set things like connection timeouts etc

Yes, we can use ORM too