SQLAlchemy是否清理原始SQL？

Question

Simply put. If i did something like

Conn.execute(RAW_SQL) 

would sqlalchemy sanitize this to prevent sql injection or does it literally just execute it? Thanks

Answer 1

No, if you pass in raw SQL with values interpolated, SQL Alchemy will not sanitise it. It'll just be executed.

Always use query parameters, at the very least.

A string object is passed straight to the underlying database connection implementation; it does support query parameters but you'll have to use the parameter style specific to the library that handles the database communication.

You can use sqlalchemy.sql.expression.text() to generate SQL with implementation agnostic query parameter syntax.