Lightweight DBAL for python

can somebody please recomend me some python DBAL library that will best suit my requirements. I would like to wri开发者_Go百科te my sql statements directly, most of the logics will be in db stored procedures (postgresql), so I only need to invoke db procedures, pass arguments to them and fetch the results. The library should help me with quoting (preventing sql inject). I played with sqlalchemy, but i think that there is no quoting helper when writing sql statement directly to engine.execute method.

Thank you

---

You should have given sqlalchemy a deeper look; It does a fine job of quoting placeholders:

>>> engine = sqlalchemy.create_engine("sqlite:///:memory:")
>>> engine.execute("select ?", 5).fetchall()
[(5,)]
>>> engine.execute("select ?", "; drop table users; --").fetchall()
[(u'; drop table users; --',)]

---

psycopg2 (via DB-API) will automatically quote to prevent SQL injection, IF you use it properly. (The python way is wrong; you have to pass the parameters as arguments to the query command itself.)

WRONG:

cur.execute('select * from table where last="%s" and first="%s"'
     % (last, first))

RIGHT:

cur.execute('select * from table where last=%s and first=%s',
     (last, first))

Note: you don't use %, and you don't put quotes around your values.

The syntax is slightly different for MySQLdb and sqlite3. (For example, sqlite uses ? instead of %s.)

Also, for psycopg2, always use %s even if you're dealing with numbers or some other type.