Allow queries with parameters to avoid SQL injection

yhat / pandasql

sqldf for pandas

MIT License

1.33k stars 185 forks source link

Allow queries with parameters to avoid SQL injection #75

Open kljh opened 5 years ago

kljh commented 5 years ago

Allow queries with parameters to avoid SQL injection and issues with escaping strings.

This means we can replace df = sqldf("select from df where id='"+id+"'") with the parametrised query df = sqldf("select from df where id=?", params = (id, )) which will work even if the variable id contains single quotes.

Thanks a lot for this nice project.

pkvprakash commented 4 years ago

@aplavin Can you please review this PR?