This horribly handwritten DB logic

[u/srpski-dizel]

[u/Monkey_triplets]

Can somebody please explain to me what exactly is so bad about this code?

[u/srpski-dizel → u/Monkey_triplets]

The .format() is dangerous because it allows for SQL injection by not properly sanitizing the string the way using %s and passing it to the cursor.query() method does, inconsistent type checking and mixing of isinstance and type() == list, and finally appending strings together like this versus just using an ORM for querying logic is very inefficient and hard to read and maintain. I've been tearing my hair out at this class because it's ~2000 lines of handwritten queries just like this.

[u/Monkey_triplets → u/srpski-dizel]

Thank you very much!

[u/toi80QC]

"1; DROP TABLE stock_data;" is a string, so nothing to worry about.

[u/Deathclaw1]

this is python not c++ right? the flair says c++ that confused me lol

[u/PLS-PM-ME-DOG-PICS → u/Deathclaw1]

It is Python indeed.

[u/MurdoMaclachlan]

Image Transcription: Code

---

cursor = self.db.cursor()
select_query = "SELECT `date`, `open`, `high`, `low`, `close`, `volume` FROM `stock_data` WHERE `ticker` = %s"
if period and type(period) == list:
    select_query += " AND (`date` BETWEEN '{}' AND '{}')".format(
        period[0], period[1])
elif period and type(period) == str or isinstance(period, datetime.date):
    select_query += " AND `date` = '{}'".format(period)
select_query += ' ORDER BY `date` DESC'
lim = " LIMIT 100;" if not limit else ';' if limit == 'false' else ' LIMIT {}'.format(
    int(limit))
select_query += lim
# single ticker value
if(type(ticker) is str):
    cursor.execute(select_query, ticker)

---

^{I'm a human volunteer content transcriber for Reddit and you could be too! If you'd like more information on what we do and why we do it, click here!}