Project: datamanagement
Issue DM-1981: Improve security for mysql in python
Revisit all code that talks to mysql from python to use parameter bindings instead of direct string substitutions. In practice: {code} conn.execute("SELECT * FROM t WHERE name=%s" % theName) {code} should be replaced with {code} conn.execute("SELECT * FROM t WHERE name=%s", (theName,)) {code} For details, see http://mysql-python.sourceforge.net/MySQLdb.html#some-examples
Story points: 5