Mastering GUI Programming with Python

Prepared queries

Quite often, data needs to be passed into a SQL query from an application. For example, we need to write a method that looks up a single coffee by ID number so that we can display it in our form.

We could start writing that method something like this:

    def show_coffee(self, coffee_id):        query = self.db.exec(f'SELECT * FROM coffees WHERE id={coffee_id}')

In this situation, we're using a format string to put the coffee_id value directly into our query. Do not do this!

Using string formatting or concatenation to build SQL queries can lead to something called a SQL injection vulnerability, in which passing a specially crafted value can expose or destroy data in the database. In this case, we're assuming that coffee_id is going ...