https://docs.python.org/3.8/library/sqlite3.html#sqlite3.Cursor



 # Never do this -- insecure!
 symbol = 'RHAT'
 cur.execute("SELECT \* FROM stocks WHERE symbol = '%s'" % symbol)
 # Do this instead
 t = ('RHAT',)
 cur.execute('SELECT \* FROM stocks WHERE symbol=?', t)
 print(cur.fetchone())
 # Larger example that inserts many records at a time
 purchases = [('2006-03-28', 'BUY', 'IBM', 1000, 45.00),
     ('2006-04-05', 'BUY', 'MSFT', 1000, 72.00),
     ('2006-04-06', 'SELL', 'IBM', 500, 53.00),
    ]
 cur.executemany('INSERT INTO stocks VALUES (?,?,?,?,?)', purchases)

More advanced, 90s Perl style: setup something like a taint bit on outside variables which has to be cleared using an escape function to avoid an error.

OOP variant: A class system could be used to make something like execute() only accept a SqlQuery instance and that class throws a fatal error if you concatenate a regular string. That still allows someone to run arbitrary strings through whatever marks strings as safe but that requires doing additional work rather than forgetting and is easier to audit.

Nicer, possibly less safe variation: implement something like Python’s __add__ / __radd__ so query + string has the string escaped automatically.

More advanced: make the query method only accept constants defined at compile time with some escape hatch function which is clearly marked as unsafe: totally_insecure_query(). You need some way to combine predefined fragments for conditionals but that should be possible in most modern languages.

Rust example: https://polyfloyd.net/post/compile-time-prevention-of-sql-in...