I am learning Database connection from MySQL Connector/Python Developer Guide.

This is the code I am using to insert data:

conn = mysql.connector.connect(user="user", password="password", host="", database="db")
cursor = conn.cursor()
query = ("INSERT INTO test(name,email) VALUES(%s,%s)")
data = ("cool", "cool")
cursor.execute(query, data)

Is this type of data insertion safe and can stop sql injection?


Yes. According to the documentation, this is the correct syntax for specifying and executing a query with parameters. Parametrized queries are immune to SQL injection; SQL injection can only occur when you mix user input directly into the query string instead of separating it out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.