linkedin/lafayette — pull request #3 by worr (2013-10-18 04:32:12+00:00)
Title: Made mysql queries safer in forensic-mysql.py

Unfortunately, MySQLdb isn't the best way to access a MySQL database in python.

Usually, to safely make SQL queries and to prevent injection (to either falsify data or to insert multiple queries), I'd use [SQL parameterization](http://www.codinghorror.com/blog/2005/04/give-me-parameterized-sql-or-give-me-death.html). However, MySQLdb doesn't offer that. Thankfully, it does offer some basic escaping. I fixed `forensic-mysql.py` as an example on how to use it.

It basically needs to be used...everywhere anyone could insert data into the database.Many of these fields I could've previously manipulated by sending malformed emails to the IMAP user that lafayette reads from.

If you want to go through and redo the SQL portions, the best tool for the job is `SQLAlchemy`. It's a bit different since it's ORM (it maps objects to database tables), but it means that you don't need to type out SQL queries in your code, and it automatically parameterizes your queries. `oursql` also offers parameterization, but isn't an ORM.

The other change of note here is that in many places, I replaced the `%` syntax with the newer `format()` method. `%` is deprecated and will be removed in a future version of python. String concatenation with `+` is also frowned upon, though not deprecated. You should move to the `format` method in new code, and gradually transition existing code.