Django: mysql query with arguments

Question

i have a MySQL query like this

cursor.execute("GRANT USAGE ON %s.* TO %s@%s", [db, user, host])

Python generate a query like

GRANT USAGE ON 'db'.* TO 'user'@'host';

But the apostrophes around 'db' are not allowed in MySQL. Any ideas?

rh0dium · Accepted Answer · 2013-05-26 04:16:28Z

1

A simple way to get around this.

grant = "GRANT USAGE ON %s.* TO '%s'@'%s'" % [db, user, host]
cursor.execute(grant)

HTH

answered May 26, 2013 at 4:16

rh0dium

7,0924 gold badges51 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Thanks. Are the arguments safe for mysql injections with this method?

It's not bullet proof - but these are typically not coming from an end user generated data.