diff options
| author | Claude Paroz <claude@2xlibre.net> | 2013-03-23 16:09:56 +0100 |
|---|---|---|
| committer | Claude Paroz <claude@2xlibre.net> | 2013-03-23 17:11:10 +0100 |
| commit | 76aecfbc4b49f5ab0613cccff1df6fab03253fab (patch) | |
| tree | 288a5c0e14ebe27d051b0ec01d16977f76b99838 /django/db/backends/sqlite3 | |
| parent | e7514e4978178ba68a872ac0004dd6f8049f3d76 (diff) | |
Fixed #9055 -- Standardized behaviour of parameter escaping in db cursors
Previously, depending on the database backend or the cursor type,
you'd need to double the percent signs in the query before passing
it to cursor.execute. Now cursor.execute consistently need percent
doubling whenever params argument is not None (placeholder substitution
will happen).
Thanks Thomas Güttler for the report and Walter Doekes for his work
on the patch.
Diffstat (limited to 'django/db/backends/sqlite3')
| -rw-r--r-- | django/db/backends/sqlite3/base.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/django/db/backends/sqlite3/base.py b/django/db/backends/sqlite3/base.py index f70c3872a8..ead325a33b 100644 --- a/django/db/backends/sqlite3/base.py +++ b/django/db/backends/sqlite3/base.py @@ -433,7 +433,9 @@ class SQLiteCursorWrapper(Database.Cursor): This fixes it -- but note that if you want to use a literal "%s" in a query, you'll need to use "%%s". """ - def execute(self, query, params=()): + def execute(self, query, params=None): + if params is None: + return Database.Cursor.execute(self, query) query = self.convert_query(query) return Database.Cursor.execute(self, query, params) |