4

Currently my code is

client = boto3.client('sdb')
query = 'SELECT * FROM `%s` WHERE "%s" = "%s"' % (domain, key, value)
response = client.select(SelectExpression = query)

The variable key and value is input by user, what are the best way to escape them in my above code?

Edit: What I concern is how to escape the fields such as we did in the past to prevent SQL injection, but now in SimpleDB

Ryan
  • 10,041
  • 27
  • 91
  • 156

2 Answers2

4

Subselects and destructive operations can't be performed using simpledb.

Amazon provides quoting rules: http://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/QuotingRulesSelect.html

You can apply this behavior in python using this function:

def quote(string):
    return string.replace("'", "''").replace('"', '""').replace('`', '``')

client = boto3.client('sdb')
query = 'SELECT * FROM `%s` WHERE "%s" = "%s"' % (quote(domain), quote(key), quote(value))
response = client.select(SelectExpression = query)
Pierre Barre
  • 2,174
  • 1
  • 11
  • 23
3

If you meant sideffect of SQL injection is deletion/destruction, SimpleDB only support querying data, if you want to protect data exposing ( that you dont want to ) check aws docs here

Note: Since the guide is good to go, i thought the link is enough

Community
  • 1
  • 1
Renjith Thankachan
  • 4,178
  • 1
  • 30
  • 47