Skip to content

Instantly share code, notes, and snippets.

@pmav99

pmav99/datacat-notes.md

Created July 11, 2019 09:26
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save pmav99/b442437d448901e99b7dd20e833916a0 to your computer and use it in GitHub Desktop.
Save pmav99/b442437d448901e99b7dd20e833916a0 to your computer and use it in GitHub Desktop.
Download ZIP
datacat notes
Raw
datacat-notes.md

SQL Injection

This is important because it is a security risk

Some typical example of the problem:

You should never use str.format or % to add user input into a query. You should always pass the query parameters separately (i.e. when you call conn.execute()).

Please read this carefully.

Unless you plan on rewriting this relatively soon, I would suggest to take the time to fix it.

Relevant reading:

Database connection Pooling

This is a performance issue.

You open and close connections which takes time and CPU at the database. If your workers only do a handful of queries then it is not a huge deal. Still, you can easily do better by using connection pooling (which means that you open a bunch of connections which you reuse, instead of a creating a new connection from scratch its time).

There are two ways to implement this with postgresql:

Logging

We discussed this yesterday.

Useful libraries

  • records. Makes working with raw SQL queries a bit easier. See an example of the API here. Perhaps the data-export could prove useful?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment