Does peewee escape parameters to protect from SQL injection?

[Tuukka Mustonen]

I'm pretty sure the answer is yes, but does this text still apply? https://github.com/coleifer/peewee/commit/ccad920f7b2758d94b5921b08e87ecad3343ab64

It resolved https://github.com/coleifer/peewee/issues/215

I couldn't find that text (or similar) from the docs anymore.

Tuukka

[Stefano Menci]

Yes.

If you create a query and print it, you will see how the query is built.

query = Model.select().where(...
print(query)

[Charles Leifer]

Yes, peewee will prevent SQL injections.

--
You received this message because you are subscribed to the Google Groups "peewee-orm" group.
To unsubscribe from this group and stop receiving emails from it, send an email to peewee-orm+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Tuukka Mustonen]

Nice, maybe add that text back to docs then (unless there was a reason to remove it...). There's nothing about security in the docs now (or I didn't find it).

Tuukka

[Charles Leifer]

http://docs.peewee-orm.com/en/latest/peewee/querying.html#security-and-sql-injection

Thanks!