search

pvarki / python-rasenmaeher-api

1 stars 0 forks source link

We use raw SQL strings with .format, this is SQL injection waiting to happen #42

Closed rambo closed 11 months ago

rambo commented 12 months ago

Just move to SQLAlchemy ORM and abstract all database operations behind Pythonic classes https://docs.sqlalchemy.org/en/20/orm/extensions/asyncio.html

Actually we go with https://python-gino.org/docs/en/1.0/tutorials/tutorial.html just like arkia11nmodels.

rambo commented 11 months ago

Fixed in #50