Hacker News Reader

I'm concerned that the code base is open to SQL injection.

I'm not a Python developer, but it looks to me like you're taking input from the user and putting it into queries without filtering it.

That said, my nonprofit helps other nonprofits use technology, and ALL of them want a volunteer-tracking system. This is a very useful, worthwhile project.

View on HN

I realize I'm pulling a huge cop-out by expecting that there aren't malicious users in terms of input (especially since the text fields are entered by an admin who presumably doesn't want to destroy their database), passwords are stored in the clear, etc. For this reason all that's in this database is volunteer names and hours, as the coordinator and I agreed that the less personal information is present, the better. :)

I'd love to get others involved in the project whose needs are slightly different and thus might have a motivation for doing a security audit, etc.

Re: SQLi, it looks good to me. OP is passing parameters to execute(), not directly concatenating values into the query. See: https://docs.python.org/2/library/sqlite3.html#sqlite3.Curso...

Reply on news.ycombinator.com