SQL injection possible

[morooshka]

Found the possibility to make an injection.
If the user input is like that:

Injection\\' OR 1=1 -- 

And you process it like that:

TABLE_NAME: str = "my_table"
INJECTION: str = "Injection\\' OR 1=1 -- "
table: Table = Table(TABLE_NAME)
query: QueryBuilder = Query.from_(table).select(table.star).where(Field("val0") == INJECTION)
sql: str = query.get_sql(quote_char=None)
connection.execute(sql)

All the table rows would be selected.
My test logs:

[2025-07-24, 15:06:30 UTC] {sql.py:814} INFO - Running statement: SELECT * FROM my_table WHERE val0='Injection\'' OR 1=1 -- ', parameters: None
[2025-07-24, 15:06:30 UTC] {sql.py:823} INFO - Rows affected: 4
...

The last message means 4 rows were selected (all that I have there)

P.S. quote char (and the defaullt double-quote) would not save you:

[2025-07-24, 15:24:09 UTC] {sql.py:814} INFO - Running statement: SELECT * FROM `my_table` WHERE `val0`='Injection\'' OR 1=1 -- ', parameters: None
[2025-07-24, 15:24:09 UTC] {sql.py:823} INFO - Rows affected: 4
...

[syork]

You'll want to use parameterized queries to avoid this.

So instead of:

Query.from_(table).select(table.star).where(Field("val0") == INJECTION)

You'd do this:

Query.from_(table).select(table.star).where(Field("val0") == Parameter('%(some_where_condition)s'))

Then you'd pass the params to the client library, in this example psycopg2:

cur.execute(sql, {'some_where_condition': 'no_injection_here'})

Note: This example is for Postgres so your placeholder syntax might be different depending on your db.

[morooshka]

@syork Thank you for your message. Acknowledging the broad benefits of parameterized queries, it's important to consider their specific performance implications. For queries executed only once, the initial compilation overhead incurred by the database engine represents an additional resource consumption without the advantage of query plan reuse. This particular trade-off is a pertinent aspect when discussing SQL optimization strategies
P.S. this issue is more about to inform the others of this to be aware then relevant