How to pass the url parameters to a mysql query as a tuple of strings

Question

I have an API endpoint as follows:

http://127.0.0.1:5000/data?params= spanish, italian, english

and this is my code in myflask.py:

@app.route("/data", methods=["GET"])
def my_api():
query = "SELECT * from tablex WHERE "
params = request.args.get("params")

if params:
   query += "col IN ('{}');".format(params)

What I expect in output is this query:

"SELECT * from tablex WHERE col in ('spanish', 'italian', 'english');"

But what I get is

"SELECT * from tablex WHERE col in ('spanish, italian, english');"

I also tried this:

query += "col IN ('{}');".format(','.join(params)) but didn't work

Don't do sql querries that way. Search the Web for "sql injection" to see why. Don't ever trust what you receive in a request — zvone
– zvone, Commented Nov 10, 2019 at 21:38
Thanks for your point. Do you have any suggestion or example I can prevent this injection? — ElisaFo
– ElisaFo, Commented Nov 10, 2019 at 21:47
because all I find is in cursor.execute() but I need to preper the query and pass to execute — ElisaFo
– ElisaFo, Commented Nov 10, 2019 at 21:49

GiovaniSalazar · Accepted Answer · 2019-11-10 22:42:26Z

1

Maybe this can help you :

languages  = ['spanish','italian','english']
string = ','.join(['%s'] * len(languages))
print("SELECT * from tablex WHERE col  IN (%s)" % string,tuple(languages))

But I would recommend that you change the SELECT for a PROCEDURE.

answered Nov 10, 2019 at 22:42

GiovaniSalazar

2,1042 gold badges11 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to pass the url parameters to a mysql query as a tuple of strings

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related