Skip to content

Support passing parameters to SQL inserts (to enable sanitation) #146

@sebastianhaberey

Description

@sebastianhaberey

We would like to use the library to insert data into our database, like so:

Execute Sql String    INSERT INTO user (firstname, lastname) VALUES ('${first_name}', '${last_name}')

The problem is that this doesn't work for names like Charles d’Artagnan. It would be nice to have a parametrized SQL string instead:

Execute Sql String    INSERT INTO user (firstname, lastname) VALUES (%s, %s)    ${first_name}   ${last_name}

It looks like the method execute_sql_string() could be used as a base for a new method execute_parameterized_sql_string().

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions