SQL injection occurs when crafted input is concatenated into SQL statement text and changes the query’s intended semantics. Pass user input separately as a parameter instead. section 6.2.3
Use these practical safeguards and distinctions:
- Keep statement text constant and supply changing values through named or positional parameters. section 6.2.3
- Avoid concatenating user input into SQL fragments; specially crafted text can alter query semantics. section 6.2.3
- Use a relational query builder for dynamic query construction where table or column names cannot be parameterized. section 6.2.2
Parameterized filtering with DuckDB
con.execute(""" SELECT count(*) FROM over_10m WHERE "GDP ($ per capita)" > $gdp """, {"gdp": 10000}).fetchone() This returns (20,), while keeping the threshold outside the statement text. section 6.2.3
con.execute("""
SELECT count(*)
FROM over_10m
WHERE "GDP ($ per capita)" > $gdp #1
""", {
"gdp":10000 #2
}).fetchone() #3
Inspect the executable pattern for separating SQL text, named input, and result retrieval. section 6.2.3
