rcsb/py-rcsb_app_file

Sql-injection prevention

Closed this issue · 0 comments

Sqlite code has been provided for testing purposes, while Redis is the recommended database for production. The provided sqlite code has not been protected against sql injection. If preferred, however, reformat sqlite by replacing f strings in KvConnection.py with question-mark format as shown in the Python docs on sqlite3. Front-end text inputs also should be replaced with multi-selection boxes and self-validating numeric selectors.