False Positives in SQL inspection
Answered
There are times when the code requires dynamic construction of SQL and other times when a text string that has nothing to do with SQL is parsed as SQL with errors. How can I help PyCharm to understand when a string is just a string and not SQL?
For example:
# PREVIOUS CODE MAY OR MAY NOT HAVE CONSTRUCTED A PARTIAL SQL STATEMENT
if sql:
sql += ','
else:
# IF NO SQL WAS GENERATED, START A SQL STATEMENT HERE
sql = """
INSERT INTO path.paths
(left_delineator_id, right_delineator_id, envelope)
VALUES """ # HERE IS WHERE THE ERROR APPEARS: '(' expected, got 'missing_value'
sql += "(%s, %s, ST_GeomFromText('%s', 4326))" % (int(delineator_pair[1]), int(delineator_pair[0]), polygon)
sql += ' RETURNING id;'
with self.get_transaction() as cursor:
cursor.execute(sql)
Please sign in to leave a comment.
Hi, append
before the string literal, e.g.
this should disable SQL injection.