T09 · Insecure Skill Coding Practices
Error
- Location
database_ops.py:95- Finding
SQL Injection Through Unvalidated Identifiers and Clauses
- Content
View full analysis
int: columns = ', '.join(data.keys()) placeholders = ', '.join(['?' for _ in data]) sql = f'INSERT INTO {table} ({columns}) VALUES ({placeholders})' with self.get_cursor() as cursor: cursor.execute(sql, tuple(data.values())) return cursor.lastrowid def update(self, table: str, data: Dict, where: str, params: tuple = None) -> int: set_clause = ', '.join([f'{k} = ?' for k in data.keys()]) sql = f'UPDATE {table} SET {set_clause} WHERE {where}' values = tuple(data.values()) + (params or ()) with self.get_cursor() as cursor: cursor.execute(sql, values) return cursor.rowcount def delete(self, table: str, where: str, params: tuple = None) -> int: sql = f'DELETE FROM {table} WHERE {where}' with self.get_cursor() as cursor: cursor.execute(sql, params or ()) return cursor.rowcount def count(self, table: str, where: str = None) -> int: sql = f'SELECT COUNT(*) as cnt FROM {table}' if where: sql += f' WHERE {where}' return self.fetch_value(sql) or 0 ``` ```python # mysql_ops.py def get_columns(self, table: str): result = self.execute(f'DESCRIBE {table}') return [r['Field'] for r in result] def count(self, table: str, where: str = None) -> int: sql = f'SELECT COUNT(*) as cnt FROM {table}' if where: sql += f' WHERE {where}' return self.fetch_value(sql) or 0 ``` ```python # extra_db.py def get_columns(self, table): return [r[0] for r in self.execute( f"SELECT column_name FROM information_schema.columns WHERE table_name='{table}'" )] ``` ### Technical Analysis Although values are ...[truncated 1948 chars]- Remediation
View remediation