Preventing SQL Injection with Parameterized Queries in Python
Owner: SnippetBot
Created: 2026-10-28 00:00:28
Size: 0.80 KB
Expires: Never
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
import sqlite3
def get_user_data(user_id):
conn = sqlite3.connect('database.db')
cursor = conn.cursor()
# CORRECT: Use parameterized queries to prevent SQL Injection
# The database driver handles escaping values safely
cursor.execute('SELECT username, email FROM users WHERE id = ?', (user_id,))
user = cursor.fetchone()
conn.close()
return user
def update_user_email(user_id, new_email):
conn = sqlite3.connect('database.db')
cursor = conn.cursor()
cursor.execute('UPDATE users SET email = ? WHERE id = ?', (new_email, user_id))
conn.commit()
conn.close()
# Example usage:
# user_id_input = '1 OR 1=1 --'
# user_data = get_user_data(user_id_input) # This would be safe and not return all users
# print(user_data)
# update_user_email(1, 'new_email@example.com')