将HTML源代码存储在python变量中

Question

Here is the code I'm using :

import urllib2
import psycopg2

add = 'http://google.com'
res = urllib2.urlopen(add)
url_html = res.read()
con = psycopg2.connect(user='postgres',password='test_pwd',host='localhost',port=5432,database='test_db')
cur = con.cursor()
cur.execute("INSERT INTO output(output) values ('%r')" %(url_html))
#cur.execute("INSERT INTO output(output) values ('''%s''')" %(url_html))
con.commit()

Now its throwing an error because of ' ' as quotes are inside the page's source code too. Can anybody help me out with this. Thanks for your help.

Answer 1

You should always escape database input, even if you're just downloading HTML from a web page, or you're making yourself vulnerable to SQL Injection. What if someone puts a drop table command in the HTML? You might end up executing it. Also, in your case escaping will actually solve your problem.

In psycopg2 you can escape parameters like this:

cur.execute("INSERT INTO test (num, data) VALUES (%s, %s)", (100, "abc'def")) (shamelessly stolen from http://initd.org/psycopg/docs/usage.html )

Read more about SQL Injection: What is SQL injection?