artefactual/archivematica — pull request #110 by mistydemeo (2014-09-08 17:16:06+00:00)
Title: Allow MySQLdb to take parameter placeholders

These allow values to be passed into SQL statements without interpolating them into the string, preventing possible SQL injection issues. For example:

```python
sql = """SELECT * FROM fpr_formatversion WHERE uuid='%s'""".format(uuid)
databaseInterface.queryAllSQL(sql)
```

Could be run as:

```python
sql = """SELECT * FROM fpr_formatversion WHERE uuid=%s"""
databaseInterface.queryAllSQL(sql, (uuid,))
```

Since the values are inserted here without string interpolation, there is no risk of quoting issues or SQL injection regardless of the contents of the values.