Search code examples
pythonsqlalchemysql-injection

Does SQLAlchemy sanitize raw SQL?

Simply put. If i did something like 

Conn.execute(RAW_SQL)

would sqlalchemy sanitize this to prevent sql injection or does it literally just execute it? Thanks

Solution

  • No, if you pass in raw SQL with values interpolated, SQL Alchemy will not sanitise it. It'll just be executed.

    Always use query parameters, at the very least.

    A string object is passed straight to the underlying database connection implementation; it does support query parameters but you'll have to use the parameter style specific to the library that handles the database communication.

    You can use sqlalchemy.sql.expression.text() to generate SQL with implementation agnostic query parameter syntax.