python and sqlite - escape input

Question

When using Python with SQLite DB, how to escape the data going in and pulling the data coming out?

Using pysqlite2

Kiger

Answer 1

Use the second parameter args to pass arguments; don't do the escaping yourself. Not only is this easier, it also helps prevent SQL injection attacks.

cursor.execute(sql,args)

for example,

cursor.execute('INSERT INTO foo VALUES (?, ?)', ("It's okay", "No escaping necessary") )

Fossa

Thanks, I wasn't sure of the python way, I am well aware of SQL attacks which is why I am trying to find best way in python. Thanks, will see if there is any more comments on this and give it a go. – Kiger

@Wizzard, unutbu is right, this works and will save you a lot of headache. For the other part of your question: pysqlite2 will return to you the objects from the DB in the right format, so you can directly use them as int, float, string, datetime,... – Chak