OpenBazaar/OpenBazaar — pull request #387 by sophron (2014-09-03 20:01:13+00:00)
Title: Counter sqli

Two important improvements:

1) INSERT, UPDATE, DELETE wrappers make use of SQLite prepared statements. This is the standard way for avoiding SQLi in SQLite, as mentioned here:
>Usually your SQL operations will need to use values from Python variables. You shouldn’t assemble your >query using Python’s string operations because doing so is insecure; it makes your program vulnerable to >an SQL injection attack (see http://xkcd.com/327/ for humorous example of what can go wrong).

>Instead, use the DB-API’s parameter substitution. Put ? as a placeholder wherever you want to use a >value, and then provide a tuple of values as the second argument to the cursor’s execute() method.

I wasn't able to make this work for SELECT operation. I'll come with a new PR explaining the problem.

2) Introduced beforeStoring method. This is for using our own own custom filtering mechanisms before executing SQL commands.

Values coming from the user should be filtered by beforeStoring and then should be passed as parameters in the prepared statement.