Programming Forums - Emulating Behaviour Of "mysql_real_escape

Programming Forums (http://www.programmingforums.org/forumindex.php)

- Python (http://www.programmingforums.org/forum43.html)

- - Emulating Behaviour Of "mysql_real_escape_string" (http://www.programmingforums.org/showthread.php?t=14636)

Emulating Behaviour Of "mysql_real_escape_string"

I need to stop mysql injections in Python's mysql library. However, mysql_real_escape_string does not exist for Python's wrapper for MySQL. Therefore, I need to emulate the behaviour of PHP's mysql_real_escape_string.

Does this cover all the bases?

def mysql_real_escape_string(string):

    return string\

        .replace('\\', '\\\\')\

        .replace('"', '\\"')\

        .replace("'", "\\'")

mysql_real_escape_string("  ' or username is not null or username='  ")

mysql_real_escape_string('  " or username is not null or username="  ')

mysql_real_escape_string("  \\' or username is not null or username= \\' ")

  \' or username is not null or username=\'  

  \" or username is not null or username=\"  

  \\\' or username is not null or username= \\\'

Re: Emulating Behaviour Of "mysql_real_escape_string"

You can stop SQL injections by using parameters, e.g:

cursor.execute("SELECT * FROM users WHERE login = '%s' AND passwd = '%s'", (login, passwd))

Re: Emulating Behaviour Of "mysql_real_escape_string"

I'll have to rework everything, but I guess it's better to use something tried and tested anyways. Thanks.