SQL injection occurs when attacker-controlled input changes a database statement and can make it run harmful commands. Keep query structure separate from user input: execute SQLAlchemy’s text(query) with a params dictionary instead of concatenating input into the SQL string. section 8.2.5
Listing 8.1 The Database class
import streamlit as st
from sqlalchemy import text
class Database:
def __init__(self):
self.conn = st.connection("haikuconn", type="sql")
def execute_query(self, query, params={}, write=False):
with self.conn.session as session:
try:
result = session.execute(text(query), params)
if write:
session.commit()
return result.fetchall()
except Exception:
if write:
session.rollback()
raise
See how the Database class executes queries with text(query) and params, and handles write transactions. section 8.2.5
