0

I was wondering if it's a good idea to use { var } in place of :var as placeholder? This is what I see in CS50 notes:

flight = db.execute("SELECT * FROM flights WHERE id = :id", {"id": flight_id}).fetchone()

This is what I am comfortable doing:

flight = db.execute(f"SELECT * FROM flights WHERE id = { flight_id }").fetchone()

In security point of view, is my way alright?

Improve this question

1 Answer 1

Reset to default
1

Especially from a security point of view, do not use f-strings (or similar measures) for building your SQL query, you might risk SQL injections. The placeholders in the query ensure the value is formatted in just the right way, and any special characters are escaped properly, so the structure cannot be changed by the values.

If I remember correctly, David talks about SQL injections around the end of week 7 lecture (looked it up: CS50 fall 2019/CS50x 2020 week 7 lecture, starting around 1:43:00).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .