- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
ID: python-flask/disable-sqlalchemy-text
Language: Python
Severity: Warning
Category: Security
The text
function from SQLAlchemy lets you build custom SQL statements. It is recommended to use the ORM functions to build queries and avoid building custom queries, which are vulnerable to SQL injections.
from sqlalchemy.sql import text
con = engine.connect()
data = ( { "id": 1, "title": "The Hobbit", "primary_author": "Tolkien" },
{ "id": 2, "title": "The Silmarillion", "primary_author": "Tolkien" },
)
statement = text("""INSERT INTO book(id, title, primary_author) VALUES(:id, :title, :primary_author)""")
for line in data:
con.execute(statement, **line)
con = engine.connect()
data = ( { "id": 1, "title": "The Hobbit", "primary_author": "Tolkien" },
{ "id": 2, "title": "The Silmarillion", "primary_author": "Tolkien" },
)
statement = text("""INSERT INTO book(id, title, primary_author) VALUES(:id, :title, :primary_author)""")
for line in data:
con.execute(statement, **line)
from sqlalchemy import text
BOOKS = meta.tables['books']
query = sqlalchemy.select(BOOKS).where(BOOKS.c.genre == 'fiction')
result = engine.execute(query).fetchall()
|
|
For more information, please read the Code Analysis documentation
Identify code vulnerabilities directly in yourVS Code editor
Identify code vulnerabilities directly inJetBrains products