Skip to main content
added 203 characters in body
Source Link
Graipher
  • 41.1k
  • 7
  • 69
  • 133

I will not repeat what has been already said in the other, excellent, answer by @avazula.

You open a few files, but never close them. This might lead to bad things. Instead just use the with keyword, which takes care of closing the file, even if an exception occurs. In addition, you can just iterate over a file and it will iterate over the lines. No need for readlines, which reads the whole file into memory (which might not be possible).

with open(filePath) as read_file:
    for line in read_file:
        ...

Python has an official style-guide, PEP8, which programmers are encouraged to follow. It recommend using lower_case for variables and functions, not camelCase.

An important thing to think about any time you use SQL are SQL injections. If there is any chance at all that a user can manipulate the content of the variables, they might be able to execute a malicious query if you are not careful.

The psycopg2 documentation even has this not so subtle warning:

Warning: Never, never, NEVER use Python string concatenation (+) or string parameters interpolation (%) to pass variables to a SQL query string. Not even at gunpoint.

To alleviate this, prepared statements exist, which take care of properly escaping input. Theyyou can be used like thisuse the second argument of execute, as mentioned in the psycopg2 documentationdocumentation:

cur_psql.execute(f"INSERT INTO {table}"
                  " (created_date, product_sku, previous_stock , current_stock)"
                  " VALUES (%s, %s, %s, %s)",
                (date_part1+ " "+ date_part2, sku, prev_stock, current_stock))

Here I have used an f-string (Python 3.6+) to insert the table name (unescaped in this case). You can properly escape it using sql.LiteralIdentifier(table) as mentioned in the other answer.

I will not repeat what has been already said in the other, excellent, answer by @avazula.

You open a few files, but never close them. This might lead to bad things. Instead just use the with keyword, which takes care of closing the file, even if an exception occurs. In addition, you can just iterate over a file and it will iterate over the lines. No need for readlines, which reads the whole file into memory (which might not be possible).

with open(filePath) as read_file:
    for line in read_file:
        ...

Python has an official style-guide, PEP8, which programmers are encouraged to follow. It recommend using lower_case for variables and functions, not camelCase.

An important thing to think about any time you use SQL are SQL injections. If there is any chance at all that a user can manipulate the content of the variables, they might be able to execute a malicious query if you are not careful. To alleviate this, prepared statements exist, which take care of properly escaping input. They can be used like this, as mentioned in the psycopg2 documentation:

cur_psql.execute(f"INSERT INTO {table}"
                  " (created_date, product_sku, previous_stock , current_stock)"
                  " VALUES (%s, %s, %s, %s)",
                (date_part1+ " "+ date_part2, sku, prev_stock, current_stock))

Here I have used an f-string (Python 3.6+) to insert the table name (unescaped in this case). You can properly escape it using sql.Literal(table) as mentioned in the other answer.

I will not repeat what has been already said in the other, excellent, answer by @avazula.

You open a few files, but never close them. This might lead to bad things. Instead just use the with keyword, which takes care of closing the file, even if an exception occurs. In addition, you can just iterate over a file and it will iterate over the lines. No need for readlines, which reads the whole file into memory (which might not be possible).

with open(filePath) as read_file:
    for line in read_file:
        ...

Python has an official style-guide, PEP8, which programmers are encouraged to follow. It recommend using lower_case for variables and functions, not camelCase.

An important thing to think about any time you use SQL are SQL injections. If there is any chance at all that a user can manipulate the content of the variables, they might be able to execute a malicious query if you are not careful.

The psycopg2 documentation even has this not so subtle warning:

Warning: Never, never, NEVER use Python string concatenation (+) or string parameters interpolation (%) to pass variables to a SQL query string. Not even at gunpoint.

To alleviate this, you can use the second argument of execute, as mentioned in the documentation:

cur_psql.execute(f"INSERT INTO {table}"
                  " (created_date, product_sku, previous_stock , current_stock)"
                  " VALUES (%s, %s, %s, %s)",
                (date_part1+ " "+ date_part2, sku, prev_stock, current_stock))

Here I have used an f-string (Python 3.6+) to insert the table name (unescaped in this case). You can properly escape it using sql.Identifier(table).

Source Link
Graipher
  • 41.1k
  • 7
  • 69
  • 133

I will not repeat what has been already said in the other, excellent, answer by @avazula.

You open a few files, but never close them. This might lead to bad things. Instead just use the with keyword, which takes care of closing the file, even if an exception occurs. In addition, you can just iterate over a file and it will iterate over the lines. No need for readlines, which reads the whole file into memory (which might not be possible).

with open(filePath) as read_file:
    for line in read_file:
        ...

Python has an official style-guide, PEP8, which programmers are encouraged to follow. It recommend using lower_case for variables and functions, not camelCase.

An important thing to think about any time you use SQL are SQL injections. If there is any chance at all that a user can manipulate the content of the variables, they might be able to execute a malicious query if you are not careful. To alleviate this, prepared statements exist, which take care of properly escaping input. They can be used like this, as mentioned in the psycopg2 documentation:

cur_psql.execute(f"INSERT INTO {table}"
                  " (created_date, product_sku, previous_stock , current_stock)"
                  " VALUES (%s, %s, %s, %s)",
                (date_part1+ " "+ date_part2, sku, prev_stock, current_stock))

Here I have used an f-string (Python 3.6+) to insert the table name (unescaped in this case). You can properly escape it using sql.Literal(table) as mentioned in the other answer.