使用torndb搜索文本的python

Question

I want when user search "lost computer" then all records that has word "lost" and "computer" will be shown by using torndb python, i know it is easy just to use SQL statement AND operator, but making a dynamic query will be dangerous because of SQL injection, for example I have query below

def RedownloadListSelect(self, searchtext):
    searchtext = "%" + searchtext + "%"
    return self.db.query("SELECT * FROM RedownloadList WHERE column like %s", searchtext)

but above only capable to search the whole word which means that "lost 1 computer" or "lost 2 computer" won't be found if user search using text "lost computer". If I split the searchtext using space and concatenante it using AND, I think it allows for SQL injection so I decide to stick with torndb feature using arguments.

Anyone has any idea how to search with multiple AND operator using a single searchtext that does not expose SQL injection threat? Thanks

Answer 1

You can do it this way:

searchtext='lost computer'
searchwords = searchtext.split()
query = "SELECT * FROM RedownloadList WHERE" + " AND ".join(["column like %s"]*len(searchwords))
self.db.query(query, searchwords)