Use SQLAlchemy to generate SQL queries #2

New issue

Open

opened 2026-06-25 15:36:46 +00:00 by eliribble · 0 comments

eliribble commented

2026-06-25 15:36:46 +00:00

Owner

Currently the program uses various string injections. See an example:

                cur.execute(
                    "SELECT task_name, completed, COALESCE(assigned_to, 'No one') FROM task WHERE user_sub = %s",
                    (sub,),
                )

These should instead be done as SQLAlchemy queries which make it much easier to ensure that the query is well-formed. It also provides protection against injection attacks.

Currently the program uses various string injections. See [an example](https://source.gleipnir.technology/Gleipnir/mechaturk/src/branch/main/backend/app.py#L283): ``` cur.execute( "SELECT task_name, completed, COALESCE(assigned_to, 'No one') FROM task WHERE user_sub = %s", (sub,), ) ``` These should instead be done as [SQLAlchemy queries](https://docs.sqlalchemy.org/en/20/tutorial/index.html) which make it much easier to ensure that the query is well-formed. It also provides protection against injection attacks.