1

I am learning Database connection from MySQL Connector/Python Developer Guide.

This is the code I am using to insert data:

conn = mysql.connector.connect(user="user", password="password", host="127.0.0.1", database="db")
cursor = conn.cursor()
query = ("INSERT INTO test(name,email) VALUES(%s,%s)")
data = ("cool", "cool")
cursor.execute(query, data)
conn.commit()
cursor.close()
conn.close()

Is this type of data insertion safe and can stop sql injection?

gnat
  • 21,442
  • 29
  • 112
  • 288
CS GO
  • 111
  • 3

1 Answers1

2

Yes. According to the documentation, this is the correct syntax for specifying and executing a query with parameters. Parametrized queries are immune to SQL injection; SQL injection can only occur when you mix user input directly into the query string instead of separating it out.

Mason Wheeler
  • 82,151
  • 24
  • 234
  • 309