Skip to main content

###No, your code is vulnerable to SQL injection!

Use something like this to prevent it:

cursor.execute("INSERT INTO table (state_int, turn_left, turn_right, move_forward) VALUES (?,?,?,?)",(database.records_table_name))

Note that you cannot (or you shouldn't) enter the table in like this:

query = '''INSERT INTO %s...'''

Ideally the table should be hard coded. Under no circumstances should it come from a user input of any kind. You can use a string similar to what you did for the table, but you'd better make 100% certain that a user can't change it somehow... See (Can I use parameters for the table name in sqlite3 ?) for more details.

The python pages quote say something like:

Usually your SQL operations will need to use values from Python variables. You shouldn’t assemble your query using Python’s string operations because doing so is insecure; it makes your program vulnerable to an SQL injection attack

Using cursor.execute will stuff the value given, so that the argument could be as listed, and when you do a query on it, that is exactly what you will get out. XKCD explains this humorously as well.

enter image description here

Grajdeanu Alex
  • 9.2k
  • 4
  • 31
  • 70